- NZNOG - lists.nznog.org

Fwd: Code red infected customers
by Steve Phillips 11 Aug '01

11 Aug '01

FYI, these are the IP's I've collected to date that are in the NZ domain, some of these will be on dynamic dialup accounts, if you would like the actual log entries which should include times they were online let me know, i'll probably clear off the log files and restart the collection at a later date as the time on the server was out by an hour <self fwap> >Date: Sat, 11 Aug 2001 18:57:54 +1200 >From: root <root(a)hangover.nz.asiaonline.net> >To: steve(a)nz.asiaonline.net >Subject: Code red infected customers > >Code Red Infected customers on our network trying to infect remote sites.. > > >202.154.128.18 : 18.128.154.202.IN-ADDR.ARPA domain name pointer >ak-d18.connections.net.nz >202.180.111.174 : 174.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-174.nas3.chc.attica.net.nz >202.180.111.18 : 18.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-18.nas3.chc.attica.net.nz >202.180.111.77 : 77.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-77.nas3.chc.attica.net.nz >202.180.111.95 : 95.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-95.nas3.chc.attica.net.nz >202.180.68.127 : 127.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-127.nas1.wgn.attica.net.nz >202.180.68.40 : 40.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-40.nas1.wgn.attica.net.nz >202.180.69.248 : 248.69.180.202.IN-ADDR.ARPA domain name pointer >202-180-69-248.ipn1.attica.net.nz >202.180.71.36 : 36.71.180.202.IN-ADDR.ARPA domain name pointer >202-180-71-36.nas4.akl.attica.net.nz >202.180.90.163 : 163.90.180.202.IN-ADDR.ARPA domain name pointer >202-180-90-163.nas7.akl.attica.net.nz >202.37.167.38 : 38.167.37.202.IN-ADDR.ARPA domain name pointer >nwp-38.world-net.co.nz >202.37.68.193 : 193.68.37.202.IN-ADDR.ARPA domain name pointer >nw3-193.world-net.co.nz >202.49.144.221 : 221.144.49.202.IN-ADDR.ARPA domain name pointer >storefrontmail.viatx.com >202.49.144.225 : 225.144.49.202.IN-ADDR.ARPA domain name pointer >stage.viatx.com >202.50.111.114 : >202.50.111.91 : >202.50.111.97 : >203.109.193.163 : 163.193.109.203.IN-ADDR.ARPA domain name pointer >203-109-193-163.ihug.net >203.109.203.103 : 103.203.109.203.IN-ADDR.ARPA domain name pointer >203-109-203-103.nzl.ihugultra.co.nz >203.167.132.64 : 64.132.167.203.IN-ADDR.ARPA domain name pointer >203-167-132-64.dialup.clear.net.nz >203.167.161.144 : 144.161.167.203.IN-ADDR.ARPA domain name pointer >203-167-161-144.dialup.clear.net.nz >203.167.164.208 : 208.164.167.203.IN-ADDR.ARPA domain name pointer >203-167-164-208.dialup.clear.net.nz >203.167.166.71 : 71.166.167.203.IN-ADDR.ARPA domain name pointer >203-167-166-71.dialup.clear.net.nz >203.167.171.155 : 155.171.167.203.IN-ADDR.ARPA domain name pointer >203-167-171-155.dialup.clear.net.nz >203.167.214.50 : >203.167.247.214 : 214.247.167.203.IN-ADDR.ARPA domain name pointer >cf4-acld.auckland.clix.net.nz >203.167.254.136 : 136.254.167.203.IN-ADDR.ARPA domain name pointer >napr-m36.dialup.inhb.co.nz >203.79.102.72 : 72.102.79.203.IN-ADDR.ARPA domain name pointer >203-79-102-72.tnt14.paradise.net.nz >203.79.103.179 : 179.103.79.203.IN-ADDR.ARPA domain name pointer >203-79-103-179.tnt14.paradise.net.nz >203.96.106.59 : 59.106.96.203.IN-ADDR.ARPA domain name pointer >203-96-106-59.dialup.xtra.co.nz >203.96.110.172 : 172.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-172.dialup.xtra.co.nz >203.96.110.66 : 66.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-66.dialup.xtra.co.nz >203.96.62.201 : 201.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-201-tollfree.actrix.co.nz >203.96.62.53 : 53.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-53-tollfree.actrix.co.nz >203.97.85.108 : 108.85.97.203.IN-ADDR.ARPA domain name pointer >a004-m001-u108.chch.clear.net.nz >210.48.102.170 : 170.102.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-102-170.iconz.net.nz >210.48.103.150 : 150.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-150.iconz.net.nz >210.48.103.4 : 4.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-4.iconz.net.nz >210.48.81.19 : 19.81.48.210.IN-ADDR.ARPA domain name pointer >p19.pool1.staticadsl.iconz.net.nz >210.54.121.65 : 65.121.54.210.IN-ADDR.ARPA domain name pointer >210-54-121-65.adsl.xtra.co.nz >210.54.199.115 : 115.199.54.210.IN-ADDR.ARPA domain name pointer >210-54-199-115.dialup.xtra.co.nz >210.54.201.186 : 186.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-186.dialup.xtra.co.nz >210.54.201.49 : 49.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-49.dialup.xtra.co.nz >210.54.217.216 : 216.217.54.210.IN-ADDR.ARPA domain name pointer >ppp-15.satlan.co.nz >210.54.221.186 : 186.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-186.ipnets.xtra.co.nz >210.54.221.194 : 194.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-194.ipnets.xtra.co.nz >210.54.224.235 : 235.224.54.210.IN-ADDR.ARPA domain name pointer >210-54-224-235.adsl.xtra.co.nz >210.54.229.174 : 174.229.54.210.IN-ADDR.ARPA domain name pointer >210-54-229-174.dialup.xtra.co.nz >210.54.233.174 : 174.233.54.210.IN-ADDR.ARPA domain name pointer >210-54-233-174.adsl.xtra.co.nz >210.54.242.194 : 194.242.54.210.IN-ADDR.ARPA domain name pointer >210-54-242-194.adsl.xtra.co.nz >210.54.247.251 : 251.247.54.210.IN-ADDR.ARPA domain name pointer >smtp.carolineeve.co.nz >210.54.254.97 : 97.254.54.210.IN-ADDR.ARPA domain name pointer >210-54-254-97.adsl.xtra.co.nz >210.54.76.237 : 237.76.54.210.IN-ADDR.ARPA domain name pointer >210-54-76-237.dialup.xtra.co.nz >210.54.77.98 : 98.77.54.210.IN-ADDR.ARPA domain name pointer >210-54-77-98.dialup.xtra.co.nz >210.54.80.49 : 49.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-49.adsl.xtra.co.nz >210.54.80.78 : 78.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-78.adsl.xtra.co.nz >210.54.8.148 : >210.54.83.179 : 179.83.54.210.IN-ADDR.ARPA domain name pointer >210-54-83-179.adsl.xtra.co.nz >210.54.84.137 : 137.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-137.adsl.xtra.co.nz >210.54.84.211 : 211.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-211.adsl.xtra.co.nz >210.54.89.14 : 14.89.54.210.IN-ADDR.ARPA domain name pointer >smtp.insteplimited.com >14.89.54.210.IN-ADDR.ARPA domain name pointer smtp.hanmerinstitute.com >210.54.98.43 : 43.98.54.210.IN-ADDR.ARPA domain name pointer >210-54-98-43.dialup.xtra.co.nz >210.54.99.167 : 167.99.54.210.IN-ADDR.ARPA domain name pointer >210-54-99-167.dialup.xtra.co.nz >210.55.103.213 : 213.103.55.210.IN-ADDR.ARPA domain name pointer >port55-103-213.jetstart.win.co.nz >210.55.106.10 : 10.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-10.ip.maxnet.co.nz >210.55.106.136 : 136.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-136.ip.maxnet.co.nz >210.55.123.35 : 35.123.55.210.IN-ADDR.ARPA domain name pointer >210-55-123-35.dialup.xtra.co.nz >210.55.146.39 : 39.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-39.dialup.xtra.co.nz >210.55.146.83 : 83.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-83.dialup.xtra.co.nz >210.55.159.221 : 221.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-221.ipnets.xtra.co.nz >210.55.159.222 : 222.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-222.ipnets.xtra.co.nz >210.55.178.166 : 166.178.55.210.IN-ADDR.ARPA domain name pointer >210-55-178-166.dialup.xtra.co.nz >210.55.228.173 : 173.228.55.210.IN-ADDR.ARPA domain name pointer >adsl-173.world-net.co.nz >210.55.57.45 : 45.57.55.210.IN-ADDR.ARPA domain name pointer >210-55-57-45.adsl.xtra.co.nz >210.55.9.105 : >210.86.24.203 : 203.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-203.adsl.xtra.co.nz >210.86.24.254 : 254.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-254.adsl.xtra.co.nz >210.86.25.142 : 142.25.86.210.IN-ADDR.ARPA domain name pointer >210-86-25-142.adsl.xtra.co.nz > >Total customers Code Red infected so far counted at : 79 -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red errata
by Brodie Davis 10 Aug '01

10 Aug '01

Has any one else noticed a big drop of traffic related to this. my stats for this week have been so far (pretty low.. but as i only have 2 world viewable port 80's) Monday : 37 (ids was playing up so only partial records) Tuesday : 599 Wednesyday : 511 Today (from 8am) : nill I am just wondering is this the norm.. or I am just lucky. (or has AoL started filting this now?) Cheers, Brodie --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 10

Vote Result and NZNOG List Changes
by Donald Neal 10 Aug '01

10 Aug '01

NZNOG People, Voting has now closed on the following proposed addition to this list's acceptable use policy: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. A total of seventy votes were recieved, with all votes cast in favour of the change. This change is therefore now in effect. During the afternoon of Monday, 13 August, I intend to change the nznog list's settings so that postings will be accepted only from addresses subscribed to one of the following lists: nznog - this list nznog-digest - the digest version of this list nznog-postonly - a new list which exists only to allow addresses subscribed to it to post to the nznog list. Messages will not normally be sent to addresses subscibed to nznog-postonly. To subscribe new addresses to one or more of these lists, send email to majordomo(a)list.waikato.ac.nz where each line of the body of the message has the form subscribe <list name> to subscribe the address from which that message is being sent, or subscribe <list name> <address> to subscribe a different address. More than one subscription request may be sent in the same message. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Given the current topic of discussion in here...
by Chris Rigby 09 Aug '01

09 Aug '01

I though this slashdot article might be on interest. http://slashdot.org/articles/01/08/09/1758200.shtml Chris Rigby Senior Systems Engineer IHUG - Into the Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[OT] 802.11 and stuff
by James Tyson 09 Aug '01

09 Aug '01

Hi all Just a couple of quick questions to you folks that know so much about 802.11. Firstly, do I really need a base station? I have my new ibook here and I want to grab the airport card to use with the Cisco Aironet base station at work, but I was thinking is it possible to just throw an orinoco card or something in my Linux box gateway and use that in place of a base station while I am at home? If not, does anyone know of any base stations in the sub $500 range that work reasonably? I am not really that worried about WEP and SSID while I am at home, because I will set my DHCP server up to only assign my card an IP address and use an encrypted tunnel to get to the net. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Looking for DialUp RAS Equipment
by Craig Whitmore 08 Aug '01

08 Aug '01

Has anyone got any Spare RAS Equipment they are willing to sell Such as: Cisco 5200/5300/5800 etc (Or Modem Cards to put in them) USR/3Com TotalControl Equipment (or any Cards for the Chassis such as netserver/Quads etc) Shiva LANRover (Whole thing or Spare Modems etc) Max Ascend 4000/6000/3000/TNT? Anything else that will take R2's and work reasonable. If you have any of the above please let me know with estimated price for Sale. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

2 1

Re: Code Red errata
by Steve Phillips 08 Aug '01

08 Aug '01

At 11:20 9/08/2001, James McGlinn wrote: >Is it possible to filter on part of the shell code payload? At least one >CR variant doesn't request default.ida - rendering it useless (I assume), >but that should let you see those hits, and allow genuine default.ida >requests through... yep, the way the filter works is you can enter any string up to 32 characters in length, I used default.ida as it was easier to type, once i had it working and had tested it I was going to parse it on the shell code string :) -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 08 Aug '01

08 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday tomorrow, Friday 10 August, please. I have so far received fifty-eight votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. My access to email between now and some time tomorrow morning may be little variable, as I am engaged in moving offices. This is therefore likely to be the last reminder of the vote. If the change is approved, I intend to make the changes necessary to restrict posting to pre-submitted addresses only on Monday, 13 August. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 08 Aug '01

08 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. I have so far received thirty votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

spammer
by Michael Coates 08 Aug '01

08 Aug '01

Hello Is there a list in NZ I can get a spammer put onto to block them from sending emails with viruses attached? Thanks

3 2