- NZNOG - lists.nznog.org

FW: [Oz-ISP] Nimda rides again
by Philip Beckmann 27 Sep '01

27 Sep '01

fyi (if you're not on Oz-ISP list or can't be bothered filtering it :) Regards, Phil > -----Original Message----- > From: Dale Clapperton [mailto:dale(a)tdce.com.au] > Sent: Friday, 28 September 2001 10:54 AM > To: aussie-isp(a)aussie.net; isp-australia(a)isp-australia.com > Subject: [Oz-ISP] Nimda rides again > > > http://www.infoworld.com/articles/hn/xml/01/09/27/010927hnnimbda.xml?0927ale rt > > Researchers say Nimda set to propagate again > > By Deborah Radcliff, Computerworld online > September 27, 2001 10:52 am PT > > > RESEARCHERS HAVE DISCOVERED a third vector to the Nimda worm, which is > set to propagate again through e-mail at 1 a.m. ET Friday. > > "We rechecked the code base to Nimda, and we found a code set that is > supposed to respread Nimda through e-mail systems starting 10 days after > machines were first infected," said Oliver Friedrichs, director of > engineering at the Attack Registry and Intelligence Service. That service > is sponsored by SecurityFocus, a business security firm in San Mateo, > Calif. > > Ten days after first infecting machines, the worm will attempt to respread > itself through readme.exe attachments, with the same payload as its > original mail-based infection. > > The impact could be significant or minute, depending on how well the IT > community has cleaned systems and patched Microsoft IIS (Internet > Information Server) and Outlook programs. The 10-day vector will likely be > less severe than Nimda was the first time because more systems have been > patched against the vulnerabilities, Friedrichs said. > > But because Nimda has spread itself to so many places on computers, > networked systems may not have been cleaned enough to prevent widespread > mailings of the virus. Therefore, Friedrichs advised IT managers to do the > following: > > -- Double-check their patches. > > -- Make sure their anti-virus software blocks Nimda. > > -- Block executables files at the e-mail gateway. > > -- Alert users not to preview or open any attachments that say readme.exe > > > ---- > Email "unsubscribe aussie-isp" to majordomo(a)aussie.net to be removed. > The information contained in this email message may be > confidential. If you > are not the intended recipient, any use, distribution, disclosure > or copying > of this information is prohibited. If you receive this email in error, > please tell us by return email and delete it and any attachments from your > system. > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[rachel@plur.net: (fwd) [Oz-ISP] USG takes control of xpnder off PAS-2]
by Joe Abley 26 Sep '01

26 Sep '01

Whole new levels of inter-list forwarding lameness, here! Interesting, though. Anybody here have preemptable capacity which has curiously stopped functioning? ----- Forwarded message from Rachel Warren <rachel(a)plur.net> ----- Delivered-To: jabley-nanog(a)automagic.org Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Delivered-To: nanog(a)trapdoor.merit.edu Delivered-To: nanog(a)merit.edu Date: Fri, 21 Sep 2001 12:59:48 -0700 From: Rachel Warren <rachel(a)plur.net> To: nanog(a)merit.edu Subject: (fwd) [Oz-ISP] USG takes control of xpnder off PAS-2 User-Agent: Mutt/1.2.5i Organization: Taco Bell, The Mexican Phone Company Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog I thought this might interest NANOG: ---------- Forwarded message ---------- Date: Fri, 21 Sep 2001 18:11:39 +1000 (EST) From: Terence <terry(a)tdce.com.au> To: aussie-isp(a)aussie.net Cc: AusBONE Members <ausbone-members(a)ausbone.tdce.com.au> Subject: [Oz-ISP] USG takes control of xpnder off PAS-2 Well, there must be a big war coming up, because the US govmint just appropriated our PAS-2 transponder, effectively shutting down our regional operations on October 15. I'm more than happy for journalists to call me. I may be sympathetic to the USG over terrorism, but they can't go around putting AUSTRALIAN REGIONAL ISP's out of business... --- Terence C. Giufre-Sweetser +---------------------------------+--------------------------+ | TereDonn Telecommunications Ltd | Phone +61-[0]7-32369366 | | 1/128 Bowen St, SPRING HILL | FAX +61-[0]7-32369930 | | PO BOX 1054, SPRING HILL 4004 | Mobile +61-[0]414-663053 | | Queensland Australia | http://www.tdce.com.au | +---------------------------------+--------------------------+ Rachel -- http://www.plur.net/~rachel/misc/stock-market-nasdaq.jpg ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Way off subject but really need a photographer
by David 26 Sep '01

26 Sep '01

Hi Guys, I am in need of a photographer in Wellington for Friday and Saturday That likes Dogs. Anyone know anyone that is looking for a few days work? Must have digital camera Please reply of list. Regards David ecig.com.au --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Network Research in NZ
by Tony McGregor 26 Sep '01

26 Sep '01

Hi All The Waikato University Network Research group (WAND) is currently going through a process of reviewing its goals and we would welcome input from the New Zealand Internet community. We are currently heavily measurement focused. Projects include: o Collection and publishing of Internet header traces (see, for example, http://wand.cs.waikato.ac.nz/wand/wits/auck/4/ and http://moat.nlanr.net/pma) o Active measurement (see http://amp.nlanr.net/) o Passive measurement hardware for OC3, OC12, OC48 and 10/100 Ethernet. (see http://dag.cs.waikato.ac.nz) o Simulation and statistical modelling of Internet traffic. See some of the papers at http://wand.cs.waikato.ac.nz) Many of our activities are focused outside NZ. We have very strong links with NLANR and CAIDA (two members of our group lead the NLANR measurement projects AMP and PMA, for example). If the opportunity exists we would like to see some of the activity of the WAND team supporting the New Zealand industry through research that is interesting to us and also meets needs here. We're open to any suggestions but a couple occur immediately: o Are there parts of the New Zealand infrastructure for which it would be valuable to make passive header traces and to do analysis? o Would a NZ AMP-like system be of interest to people? (I.E. active measurement of delay, loss and path etc). If you have any suggestions, or comments, please let me have them. Thanks Tony ---------------------------------------------------------------------------- Tony McGregor Mail: T.McGregor(a)cs.waikato.ac.nz Department of Computer Science Phone: +64 7 838 4651 Waikato University Fax: +64 7 858 5095 Private Bag 3105 Home: +64 7 825 5040 mobile: (021)313004 Hamilton, New Zealand www: http://www.cs.waikato.ac.nz/~tonym ---------------------------------------------------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Clear IP accounts for 30% of hits?
by PhoneNet 26 Sep '01

26 Sep '01

Thanks to those who replied before.... I've done some further checks nad see that 5 IP numbers account for 1272 hits on my site this month so far... whois tells me they are Clear Communications and the role of these are Clear Communications Networks Objects Maintainer? Contact address is netobjs(a)clear.net.nz so I will contact them to see what it is... but this seems a little excessive for something that "might" be checking the site still exists.... that's about 50 + hits per day..... Ian --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Clear IP accounts for 30% of hits?
by PhoneNet 24 Sep '01

24 Sep '01

Apologies if this has appeared onthe list before but I have not seen it appear.... Can anyone explain to me why the IP 203.97.10.171 accounts for over 700 hits on my site this month... it appears to be a Clear network/internet Object IP.... It accounts for almost 30% of the hits on my site! Ian Cousins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Xtra Abuse Reports
by Mark Foster 23 Sep '01

23 Sep '01

Maybe someone from Xtra can point out to me why xtra no longer take network abuse reports via email ? security/abuse(a)xtra now autorespond with a message pointing at a website requiring a form to be filled out.. Strikes me as a huge waste of time - who the hell is going to want to dob in spammers if it now takes 4 (or more) times longer to fill in a stupid web form than it doesnt to click view-headers - forward and add comments at the top? Xtra trying to dodge their responsibilities in keeping their users in check by making life harder for those who merely want spammers off their backs? *sigh* Mark. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

RE: Xtra Abuse Reports
by Stephen Andrew 23 Sep '01

23 Sep '01

> -----Original Message----- > From: Dylan Reeve [mailto:dylan(a)wibble.net] > Sent: Monday, 24 September 2001 12:41 > To: Mark Foster > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: Xtra Abuse Reports > > > On Mon, 24 Sep 2001, Mark Foster wrote: > > > Maybe someone from Xtra can point out to me why xtra no > longer take network > > abuse reports via email ? security/abuse(a)xtra now > autorespond with a > > message pointing at a website requiring a form to be filled out.. > > It's interesting, I reported someone a while ago (an IRCer with > life_stages who I figured Xtra should talk to). I got the > auto responder telling me they didn't take email. [snip] I have to admit to being pretty pissed about this as well. I tried to report an Xtra user who has been throwing SirCam at our mail servers for a week (~450 blocked at this stage) and successfully ignoring the "you have a virus you idiot" email they will have been receiving for every single one of them. First my email to abuse failed so I went to the form they suggested only to find the the "mail/news abuse" form is utterly inappropriate for this type of problem. For one thing, YTF do they want (as mandatory fields) my Xtra login and password to report abuse by one of their users? And they want a copy of the "offending" part of the email. Everything after "Content-Type: multipart/mixed; boundary=" is pretty offensive if you ask me. I would have been happy to provide them with the complete MIME encoded trojan but they only accepted the first 1500 characters of it. Does anyone know if complaints(a)xtra.co.nz is likely to get to anyone useful? If I don't get some kind of response from Xtra today I'm almost pissed enough to bounce all future offending email to help(a)xtra until they do. -- Andrew J. Stephen Phone +64 4 496 4484 Team Leader, Network Operations Mobile +64 21 2400621 New Zealand Post Fax +64 4 496 4914 "Certainly, Windows XP is no Calista Flockhart. XP has so much pomp and circumstance that it's front-end weighs more than that of the cast of Baywatch." -- JonnyGURU, http://www.systemlogic.net/agurusworld/19/ This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Telstra Saturn off air?
by PhoneNet 21 Sep '01

21 Sep '01

Thanks to Juha and David for the replies.... we are on a Citylink connection to Netlink and could get anywhere inside NZ but until 5:30pm approx could get no further... My sister rang me to see what was up also as she could not log in to Paradise via phone... Mind you I'd still like the courtesy of a call from Telstra Saturn to explain the problem...... after all I'm a business and paying business rates for a service.... Ian --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telstra Saturn off air?
by PhoneNet 21 Sep '01

21 Sep '01

Anyone out there tell me if Telstra Saturn has gone off the air.... I've reported a failure to their afterhours help-desk (answered by no less than an answering service!) indicating we have been unable to get to any destination outside New Zealand for almost three hours - I've yet to receive a response.... We are running on our backup facility using one of their competitors but this is less than satisfactory... and sadly its not the first time its happened recently.... Anyone got any inside info ?.... Ian Cousins Director, PhoneNet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0