- NZNOG - lists.nznog.org

Mailwasher (again)
by Simon Lyall 07 Oct '02

07 Oct '02

Sorry to divert people from the Microsoft bashing but I'd thought I'd bring this up again. I mentioned a few months ago about Mailwasher forging bounces, anyway I was hoping they would go away or their latest version would fix the problem but it doesn't appear that way. Checking our outgoing queues around 50% of emails waiting to go out appear to be mailwasher forgeries ( bounces from our mail servers are elsewhere) and I'm getting a little worried. I really try hard to get customer email delivered and I don't what "normal" email to get delayed when it gets stuck behind mailwasher junk. Just wondering what others are doing? Private email is okay. I'm trying to avoid blocking or deleting them if I can. One suggestion was to forward them all to feedback(a)mailwasher.net :) . The other problem is that it is fairly hard to actually pick these messages out from others in the queue safely. Maybe I can sic the fraud squad on Mr Bolton for forging my email address. FDrom their FAQ: Q. How does MailWasher bounce messages? A. MailWasher uses an algorithm to determine the best route to send the bounced message back (from, reply to, return path) and actually sends the bounce back via your isp's postmaster, so it looks exactly like it has come from your isp and not from you at your address. If the spammer has used a fake address, then your bounce message will itself be bounced back to the postmaster and you won't receive the bounced bounce email. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

11 22

Re: Mailwasher (again)
by Simon Byrnand 02 Oct '02

02 Oct '02

At 11:11 3/10/02 +1200, Simon Lyall wrote: >On Thu, 3 Oct 2002, Simon Byrnand wrote: >> I have to agree here. By definition email should have a return address if >> it is "genuine". If the domain name of the "from" address doesn't even >> exist, then its almost a sure bet that the email is bogus, and I see no >> reason it should be accepted. Most MTA's seem to default to this action as >> well. > >I guess you don't get email from people who post to newsgroups, most of >them use bogus addresses so if they reply via email to a post the address >will not be legit ( john(a)notihug.co.nz.nospam sort of thing ). Most newsreaders I've seen that have email integrated allow you to set a different email address for posting to the news group than for sending email. Even Outlook Express does this. People writing newsreaders know that fake address are almost mandatory to avoid being spammed....Newsreaders that don't have integrated email will be launching the normal email program with normal email address. You definately have a point, but I've honestly never come across this actually happening before. >Checking around I also came across: > >From: Promos(a)Glengarry Wines > >Which appears to be a legit little mailout sent last week from >e-wine(a)Glengarry.co.nz . I didn't see any others in the search. Are you talking about the envelope-sender address or the "From:" header ? It looks like you're talking about the From: header here. I'm (and presumably Chris was) talking about the envelope from address, as exchanged at the beginning of the SMTP transaction... >Our spam filtering also has a "No MX for From address" rules that helps >block those. Still if you feel comfortable blocking customer's email on >that basis I guess it's your choice. It's not part of a spam filter, its just a standard sendmail setting, which defaults to on. (I could turn it off if I wanted to) You made me curious though, so I did a quick survey of the ISP's listed in iMAG to see if they'd accept a message with a bogus domain as an envelope from address: (not a very scientific survey, but..) Actrix: Yes Baycity: No Clear Net: No Ezysurf: No E3: No HyperNet: Yes Iconz: No Igrin: No Ihug: Yes Inspire: No Iprolink: Yes Jafa Net: No Kc Computer: No Maxnet: Yes Net4U: Yes Orcon: Yes paradise.net: No Planet: No Quik: No Quicksilver: No Slingshot: Yes Valuenet: Yes Watchdog: Yes Wave: No Worldnet: Yes Xtra: Yes Zip Internet: Yes Thats 13 Yes's, and 14 No's. A couple of remarks - a few are actually virutal ISP's sharing the same mailserver so that would skew the results a bit, also I only checked the primary MX. I also suspect that it really comes down to the defaults of the mailserver in question rather than a thought-out policy, as most (but not all) the servers that rejected the bogus message were sendmail, or looked like sendmail, and that is the default of sendmail. (As an aside, I noticed more than one who were running ancient versions of sendmail that have, umm, known bugs.... ahem :) Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: [NZNET] RE: Virus alert
by Saby Singh 02 Oct '02

02 Oct '02

1 0

Re: [NZNET] RE: Virus alert
by Mark Foster 01 Oct '02

01 Oct '02

On Wed, 2 Oct 2002 01:52:46 +1200 (NZST), Lin Nah <lin(a)darkmere.gen.nz> wrote : > Having said all that, I will admit that I work for an ISP that sets up > its customers on Outlook or OE. I think most of us know why that > happens. If you don't you can email me for a longer spiel 8) > Should we be doing more to educate our users? The answer would be yes. > I would like to find out what other NZ ISPs are doing in this area > with the hope of learning what works and what won't. A small clarification, I nearly posted this yesterday but it didnt seem appropriate or required at the time... Im one of the helpdesk team at the ISP Lin also works for. Our helpdesk is familiar with Outlook Express but that doesnt mean we're close minded about it. We regularly support clients who use other mailing software and as long as the software is reasonably generic we manage. We dont force our clients to use OE, but we do suggest it to our clients *because its there*. The differentiation is important, and stereotyping against helpdesk types isnt going to help. We all start somewhere. :-) I run Eudora in Sponsored mode and find it more than adequate - never caught anything through that, and I have never run resident antivirus either. (I manually scan my system from time to time using F-Prot for DOS.) Prior to using Eudora I used Netscape Messenger (4.x) and found this was also pretty good, although the limitation to only one mailbox is what forced me to migrate. Now that Netscape 7 is out I may consider switching back soon.... I think most ISP helpdesks crewed by reasonable people will accept that their clients dont *have* to use Outlook Express, and the only reason they may encourage their clients to use it is that especially for the less-than- technically-savvy sort, OE is easy to setup, and provided with all versions of Windows from 98 upward. If you work for an ISP and you dont have support staff familiar with a broader range of email clients than Outlook and Outlook Express, I would seriously suggest some more training is in order: Eudora, Netscape Messenger and Pegasus come to mind as alternatives, but theres obviously a lot more. </end rant> Mark. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: [NZNET] RE: Virus alert
by Donald Neal 01 Oct '02

01 Oct '02

I'm not really happy that this sort of posting meets the AUP, which talks about discussion between operators. There are cetainly announcements which may be of value to the list, but these seem to me to be characterised by not being present on a routine basis in other forums. I think that to allow announcements of this kind would have an unacceptable effect on the signal to noise ratio of the list. Unless people particularly want to see these here, I intend in future to treat them as outside the AUP. - Donald Neal NZNOG List Administrator > E-Secure-IT has just received this field report: > > While it does all the normal mass mailing stuff, own smtp engine, > harvests address lists etc this one did something really weird that > I've never seen before- it sent a postscript print job to > every printer > it could find. > > The scary thing was it even picked up printers attached to parallel > ports and which were not shared and sent the print job to them too. > I know it tries to access network shares, but looks like it tries to > access print q's also, be interested to see if anyone else has > seen this? > > FYI can confirm that NAV sigs of 30/9 do detect and clean. > > Arjen > www.e-secure-db.us ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 01 Oct '02

01 Oct '02

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This posting, or one like it, is sent to all subscribers each month. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Auckland Peering Exchange See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there. About This Mailing List This list has around 370 subscribers, increasing by a few each month. You may only post to the list from an address subscribed to one of the lists described below. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations, nor the administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrator remains happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Post-only Mailing List An address from which you wish to post, but which will not receive messages from the list, may be subscribed to nznog-postonly. You will presumably want to have another address subscribed to the main nznog list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: [NZNET] RE: Virus alert
by Arjen De Landgraaf 01 Oct '02

01 Oct '02

E-Secure-IT has just received this field report: While it does all the normal mass mailing stuff, own smtp engine, harvests address lists etc this one did something really weird that I've never seen before- it sent a postscript print job to every printer it could find. The scary thing was it even picked up printers attached to parallel ports and which were not shared and sent the print job to them too. I know it tries to access network shares, but looks like it tries to access print q's also, be interested to see if anyone else has seen this? FYI can confirm that NAV sigs of 30/9 do detect and clean. Arjen www.e-secure-db.us - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Updated ASN allocation to ARIN
by Rob Thomas 01 Oct '02

01 Oct '02

Hi, NZNOG folks. [ Apologies to those of you who have seen this post in other fora. ] A range of ASNs have been allocated to ARIN as of September 2002. The range is 26624 - 27647. You may wish to adjust your filters. The definitive list can be found here: http://www.iana.org/assignments/as-numbers I have updated my bogus ASN monitoring to reflect these changes. You can see the list of networks that leak bogus ASNs here: http://www.cymru.com/BGP/asnbogusrep.html Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [NZNET] RE: Virus alert
by Joe Abley 01 Oct '02

01 Oct '02

[I keep trying to redirect this noise somewhere else. Seems like some peoples' mail clients don't respect standard headers, or something] On Tue, Oct 01, 2002 at 04:47:16PM +1200, James Spooner wrote: > Are you in fact an expert on car safety, or do you buy/travel in a car based > on what you know about car safety? I'm no expert. > If in fact you do, does this not make you a parallel to someone using > windows and outlook express, who 'should know better'. > > Why do you think you travel in a particular car, is it perhaps because it's > available and it gets you from A to B? Sure. I don't make a habit of travelling in cars which are not licenced to drive on the road, though, and that affords me some safety without needing first-hand, expert knowledge of the dangers involved. > I think that the Car vs Computer parallel in fact works in favour of windows > in this case Joe. I don't follow you. There are safeguards set up to ensure people don't drive in unsafe cars, regardless of how little they personally know about car safety. There are no safeguards set up to encourage people not to use unsafe mail clients. The regular virus bulletins could say "as with this other large list of security problems, this one can be avoided simply by using a different mail client", but they don't. ISPs could stop shipping OE, or could find ways to encourage users to install different mail clients, but they don't. > Check my headers if you wonder which client I use :) So why do you use it? Joe - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 6

RE: Virus alert
by Arjen De Landgraaf 30 Sep '02

30 Sep '02

Hi Joe, We could state that in our advisories, However, wouldn't it be on the same line as: Avoid car accidents, disable all petrol and diesel? Personally I would love to have the death rate on the road reduced to 0. If this is realistically achievable right now is another question. The reality is that Microsoft and all its products are a very large part of the global business world right now. Just as unsafe cars. We can make them somewhat safer by awareness and vigilance, just as driving a car. That is not to say that we don't agree with you, but the other side of the coin is that there are plenty of "non-windows" threats around; SSL, apache etc also have their own vulnerabilities. Arjen -----Original Message----- From: Joe Abley [mailto:jabley(a)automagic.org] Sent: Tuesday, October 01, 2002 3:40 PM To: Arjen De Landgraaf Cc: 'Simon Byrnand'; nznog(a)list.waikato.ac.nz Subject: Re: Virus alert On Tue, Oct 01, 2002 at 03:16:57PM +1200, Arjen De Landgraaf wrote: > From www.e-secure-it.us > > DETAILED DESCRIPTION OF BUGBEAR, HOW TO RECOGNISE AND FIRST AID KIT. It continues to amazme me that the preventative measure "do not use microsoft e-mail clients", or even "do not use windows" is never suggested as part of these bulletins. I think ISP and IT helpdesks of the world would do everybody a big favour if they just stopped supporting mail clients which make it so trivial to execute encapsulated scripts. "I propose that we deploy Microsoft Outlook". "You're fired. Never insult us with your presence again." Mmm. "I have a problem with my e-mail." "Does it say Outlook Express at the top of the window?" "Yes." <click> brrrrrrr Reply-To set :) Joe - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8