- NZNOG - lists.nznog.org

Next generation of SPAM
by Philip D'Ath 20 Aug '02

20 Aug '02

Take a look at: http://www.directadvertiser.com/ It may become the next generation of SPAM. What these people appear to be doing is using Windows Messenger (note, not the same as MSN messenger) [aka, this method uses "net send ..."] to send advertising to people's desktop. The recipient of such a message gets a dialog pop up on their screen. Nothing amazing in the method - but they have wrapped it up in a simple interface so that anyone can do it. I think this is going to mainly affect dial up users with no firewall, as it shouldn't work through PAT connections [aka JetStream/Start] or firewalls. Philip D'Ath, BCMS, MCP, CCNA, CCDA. http://www.ifm.net.nz/ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 17

Re: Next generation of SPAM
by Juha Saarinen 20 Aug '02

20 Aug '02

On Wed, 21 Aug 2002, Adrian Smith wrote: > It appears to be using UDP on port 135, > > which according to www.iana.org/assignments/port-numbers is for > > epmap 135/tcp DCE endpoint resolution > epmap 135/udp DCE endpoint resolution If I read it right (too lazy to do a tcpdump), it depends on which version of Windows, and whether or not you've killed off NetBIOS over TCP/IP in favour "direct hosted SMB" http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q204279& -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Next generation of SPAM
by Adrian Smith 20 Aug '02

20 Aug '02

It appears to be using UDP on port 135, which according to www.iana.org/assignments/port-numbers is for epmap 135/tcp DCE endpoint resolution epmap 135/udp DCE endpoint resolution Adrian Smith >>>> "Juha Saarinen" <juha(a)saarinen.org> 21/08/2002 11:53:38 >>> >Gordon Smith wrote: >> Looks like a copy of an open source tool that was around some time >> ago. Also has bogus domain registration details, and the address on >> the site is in spammer paradise (Florida). >> >> I believe that the MS NET SEND command relies on NetBIOS over TCP, so >> having something like this at the borders should make it a non-issue: >> >> access-list 101 deny tcp any any eq 137 >> access-list 101 deny tcp any any eq 138 >> access-list 101 deny tcp any any eq 139 >You might have to add TCP and UDP 445 to that list, for Win2K/XP. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

peer (fwd)
by Matt Camp 19 Aug '02

19 Aug '02

Tim assures me he's fixed it this time..... As before, please apply this to any domestic peering session with either AS4768 or AS7714.

2 1

Noshade size
by nznog 19 Aug '02

19 Aug '02

------------------ Virus Warning Message ------------------ word is removed from here because it contains a virus. ------------------------------------------------------------- ------------------ Virus Warning Message ------------------ Found virus WORM_KLEZ.H in file word The uncleanable file is deleted. For more information regarding Xtra's anti-virus email filter please visit http://xtra.co.nz/anti-virus Please do not reply to this mailbox, as it is not managed. Any enquiries regarding anti-virus should be directed to anti-virus(a)xtra.co.nz -------------------------------------------------------------

1 0

"A secure, zoned Internet within five years"
by Juha Saarinen 15 Aug '02

15 Aug '02

http://www.theregister.co.uk/content/6/26695.html Interesting read. -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Peering
by Matt Camp 15 Aug '02

15 Aug '02

Beloved Peers, Update to the TelstraClear Domestic Peering Prefix-List Please remove: 202.0.32.0/20 le 24 202.0.50.0/24 Please add: 202.0.32.0/19 le 24 202.37.137.0/24 Full list attached.

4 8

FW: Another anti-spam tool
by Gordon Smith 14 Aug '02

14 Aug '02

Just a heads-up for everyone - just found a customer using a nasty little tool called spamstalker. Not only does it forge headers when the user bounces messages, it also attempts a sendmail HELO buffer overflow exploit. It's distributed out of the U.S. Needless to say, we'll be contacting the author... Cheers, Gordon Smith CCNA Network Operations Manager MoreNet Ltd - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Fwd: Outage in Wellington
by Richard Naylor 14 Aug '02

14 Aug '02

At 04:41 p.m. 05/08/2002 +1200, Peter Mott wrote: >Are you saying that CityLink does not have UPS and autostart generator >on-site to run the whole works for at least 8 hours? I wondered when this would come up. CityLink has a different architecture and there is no "central office". Switching centers have ups and generators and smaller buildings just have UPS. But that doesn't guarantee anything. Y2k showed up a lot of "interesting effects" and I'm sure they haven't all been rectified. Having a geny in the building doesn't mean its tested and feeds everywhere you think it does. BTW - the building people mentioned this was their first outage in 7 years. In the case of this morning, we (and the other telcos in the room) run off the local power and took a short hit of around 15 minutes, despite a local outage measured in hours. We also elected to go to geny due to the switching issues the power boys were facing. We also supplied power to other tennants who had a need. If you have ever closed an 11kV switch on a fault in a metro ring main sub, you will understand why we made that decision. "did the earth move for you ?" is being polite. "Sudden suntans", stuck HT gloves, etc sometimes result. (aside: HT gloves come up to your elbow, when they are "stuck" it means they've melted to something, normally the switch handle or the wall on the other side of the room from where you were not so long ago.) Now whats really interesting is that after my earlier post, an ISP contacted me to see if the outage in Courtenay Place was the cause of two dropped pings in Thorndon. He mentioned that some of todays NZNOG discussion was already posted in a security list (?) being sent around, probably misquoted. My concern is that as a list we share fairly openly about incidents mixed with a degree of good humour and frequent light relief. If an unknowing party is quoting the list, then we need a closed list or reduce the chatter or even the info conveyed. Summary - this mornings outage wasn't a simple - NO POWER. It was complex, with enough other indicators to fool experienced (power) operators. They actually did a good job. rich richard.naylor(a)citylink.co.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Domainz falling prey to spambots?
by Saby Singh 13 Aug '02

13 Aug '02

1 0