- NZNOG - lists.nznog.org

Increase in Code Red activity?
by Brian Gibbons 04 Aug '01

04 Aug '01

We have noticed a large increase (10 fold) in CodeRed activity since bang on midnight last night. The probe rate seems to have now leveled off at one probe per IP address every three minutes. This activity was actually noticed from monitoring of broadcast traffic on an ethernet LAN (TCP SYN to Black hole LAN IP address). If WorldNet are listening, these two systems are hitting us regularly 210.55.74.165 210.55.76.51 Cheers BG. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

CodeRed Worm Stats
by Craig Whitmore 04 Aug '01

04 Aug '01

I just did some graphs of the codered worms attacking over today.. and have a look at http://www.nzdsl.co.nz/codered The last batch of attacks started about 11pm last night.. This is from 2 completely different networks in NZ and the results where about the Same The 1st graph is 1 Machine only and the 2nd Graph is a C Class. Pretty Scary.. Anyone got any similar stats?? The worse offenders are a couple of machines @ worldnet so far. Thanks Craig Whitmore Orcon Internet http://www.nzdsl.co.nz

1 0

FW: Alert: New version of Code Red, XXXX
by Chris Woodrow 04 Aug '01

04 Aug '01

Cross posted from the NTBugtraq list -----Original Message----- From: Russ [mailto:Russ.Cooper(a)RC.ON.CA] Sent: Sunday, 5 August 2001 3:48 p.m. To: NTBUGTRAQ(a)LISTSERV.NTBUGTRAQ.COM Subject: Alert: New version of Code Red, XXXX -----BEGIN PGP SIGNED MESSAGE----- Just a quick FYI, there is a new version of Code Red which appears to be spreading rather rapidly. - - Appears to be a new re-write. - - Drops some sort of remote access trojan. - - Turns off System File Checker (Windows File Protection.) - - Moves CMD.EXE to the scripts directory in IIS - - Looks like the way they make the entry into code very differently than before. - - If your IDS is looking for "NNNN", forget it (but then you should have been shot if you used this string anyway) Cheers, Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor p.s. if we don't respond right away its because we're now going to go and light the fireworks here at my retreat. Might as well have lots of fireworks tonight! -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.2 iQCVAwUBO2zCARBh2Kw/l7p5AQH95wQAqjGp7vRYK8SYky/ydyU1wxBmCe2c8Mpd DBdxrv+TY9112ZuH663ZspUOXThS9oeEyT4sdbVYNv8Z28nMipbioyTXYa5dw8po 21tkilo6ZoGX+AmKJ6Kz7WDvMpHpEfzDr3JHGtxuev0/rclXeRSN4urypMR3YnRz uw5ZW/F3U/I= =OhCV -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- Delivery co-sponsored by Trend Micro ============================================================================ TREND MICRO REAL-TIME VIRUS ALERTS If you would like to know about a virus outbreak before CNN and ZDNet get Trend Micro Virus Info Feed FREE. Simply copy and paste a small piece of code to give your visitors a real-time top 10 list and the latest virus advisories. Setup takes just 10 minutes and requires no server-side code on your Web site. All content is updated automatically from Trend Micro's Web site. http://www.antivirus.com/banners/tracking.asp?si=8&bi=237&ul=/syndication/ vinfo/ ---------------------------------------------------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Different Code Red?
by Thomas Salmen 04 Aug '01

04 Aug '01

For those who havn't seen yet - -----BEGIN PGP SIGNED MESSAGE----- Just a quick FYI, there is a new version of Code Red which appears to be spreading rather rapidly. - - Appears to be a new re-write. - - Drops some sort of remote access trojan. - - Turns off System File Checker (Windows File Protection.) - - Moves CMD.EXE to the scripts directory in IIS - - Looks like the way they make the entry into code very differently than before. - - If your IDS is looking for "NNNN", forget it (but then you should have been shot if you used this string anyway) Cheers, Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor p.s. if we don't respond right away its because we're now going to go and light the fireworks here at my retreat. Might as well have lots of fireworks tonight! -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.2 iQCVAwUBO2zCARBh2Kw/l7p5AQH95wQAqjGp7vRYK8SYky/ydyU1wxBmCe2c8Mpd DBdxrv+TY9112ZuH663ZspUOXThS9oeEyT4sdbVYNv8Z28nMipbioyTXYa5dw8po 21tkilo6ZoGX+AmKJ6Kz7WDvMpHpEfzDr3JHGtxuev0/rclXeRSN4urypMR3YnRz uw5ZW/F3U/I= =OhCV -----END PGP SIGNATURE----- Quite exciting really, isn't it? Regards, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 -----Original Message----- From: Dan Langille [mailto:dan(a)langille.org] Sent: Sunday, 5 August 2001 4:00 p.m. To: Juha Saarinen Cc: nznog(a)list.waikato.ac.nz Subject: Re: Different Code Red? On 5 Aug 2001, at 11:53, Juha Saarinen wrote: > I'm getting lots of hits on my home box, unfortunately. 142 since August > 1 is the latest count. :-( > > Noticed that the GET requests look different now: [snip] Some look different: [dan(a)dev:/var/log] $ grep -c "default.ida?X" /var/log/httpd-access.log 12 [dan(a)dev:/var/log] $ grep -c "default.ida?N" /var/log/httpd-access.log 116 [dan(a)dev:/var/log] $ grep -c "default.ida" /var/log/httpd-access.log 128 The above represents the last 24 hours EST. All hits were against the IP address, not against any known domain (i.e. the HTTP headers did not include a domain name). -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red v. II
by Juha Saarinen 03 Aug '01

03 Aug '01

Arrghhh... three times as many hits: pts/0 juha(a)vimfuego:/mnt/hdb6/home/juha$ grep -c default.ida /var/log/httpd/access_log 54 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

The Wellington Wander
by Dean Pemberton 02 Aug '01

02 Aug '01

Ok the numbers are in. Wellington scored much less usage on the wireless front Well less on the 'being able to pick up with a dinky antenna on the sidewalk' front I happen to know for certain that there are wireless stations out there that I missed Wellington seems to have a few hot spots rather than a general level of wireless. It does score higher on the security side though. Of the 17 networks that I saw, 9 were using WEP The ones that weren't however did try valiantly to give me IP addresses and invite me onto their networks. This kinda freaked me out (this is not an intrusion attempt remember) so I ended up disabling all protocols on that interface In the spirit of Tim Allen I think I need more power. So I'm on the lookout for a larger antenna, and I think I know just the place to get one on loan =) Later Dean --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

Re: Dean's Wireless Walkabout
by Dean Pemberton 02 Aug '01

02 Aug '01

HAHAHAHA ROFLMAO Choccie Fish for Joe here. Yes of course I mean 802.11 hahaha - I'm still laughing at that cock up. So how many people were worried that I could see their Vlans from the street? Dean On Wed, Aug 01, 2001 at 10:48:38PM +1200, Joe Lewis wrote: > > Hi, umm feel free to shoot me down but don't you mean 802.11(b)? > > --- > Joe Lewis > > On Wed, 1 Aug 2001, Dean Pemberton wrote: > > > > > Hi all; > > > > Yes this might be a first, I'm going to drag the topic BACK to something network related. > > > > I happen to be in Auckland today. Flew in for customer chit chat which will happen tommorow. > > Had a spare afternoon and no one to see so I thought I might do the geek thing and see how little old Auckland was getting along with it's wireless networking. > > > > SO, I slapped the 802.1Q card into the laptop and strapped the GPS onto the outside of my backpack and went for a walk. > > > > I walked down Queen Street from the top to the water, and then back up to Albert St to Wellesley then back up Symonds to my hotel. > > > > Well. Auckland sure is brimming with wireless. But the concern (and I spose the reason that I posted this at all) was that most of it is insecure. > > > > Now I'm a good guy. I don't want to get access to anything, god knows I see enough internet as it is. I just wanted to see how many places had embraced the 802.1Q fad. > > > > So all in all 29 networks jumped out and grabbed me as I was walking past. only 4 of them were using WEP. > > Now because I didn't actually try to gain access to any of them, I have no idea what the internal security of them is like. But I'm not expecting much. > > > > I don't think I sniffed anything off the sky tower, I was only using the small antenna on the card. > > > > So if you run a wireless network in the center of Auckland and you were using the strategy of "Oh it will never make it down to the street" Then you are wrong and you might like to put some more security on. > > > > I thought about mailing my networklist out as well. But I decided against it. Mainly because it has exact GPS locations and network names. It would make easy pickings for anyone who wanted to gain access. > > If you want to mail me privatly with your network name and/or card MAC address then I will give you a yes or no answer. > > > > Dont feel alone though. I've done the same in North Sydney and come up with similar numbers. > > > > Next week wellington. > > > > Have fun > > > > Dean > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 10

Proposed Change to Acceptable Use Policy
by Donald Neal 02 Aug '01

02 Aug '01

NZNOG People, It is not always obvious, but this list does have an acceptable use policy. Here it is: ---------- NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. ---------- This has served us well enough for a number of years. I now propose the following addition: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. In the interim, I intend to proceed as I outlined previously. I shall issue formal warnings for irrelevant or abusive postings, and shall act to block postings as soon as a third warning within thirty days is issued to any individual. To avoid any appearance of retrospective action, I shall start counting warnings only from the appearance of this posting to the list. NB: This wiping of the slate excludes persons who have during the last week threatened me with legal action or have threatened to approach my employers to get them to influence my issuing of warnings for inappropriate posting. I consider that those involved have received far more warning than most people already. If a majority of votes cast support the change, this will become permanent practice, and the list will switch in the near future to accepting postings only from addresses supplied in advance. If the majority oppose it, we shall return to relying on people's goodwill. Unless someone else has a better idea? Donald --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: IP Address Management software.
by Steve Lang 02 Aug '01

02 Aug '01

Hiya. > Solarwinds (solarwinds.net) have a pretty cool suite of tools > that include > among others, IP management tools. They cost, but if you have > real buisiness > needs they are more cost effective than other commercial > solutions (Ci$co > included), and will quickly justify the cost. I had found them as well. Useful, and not that expensive when compared with others. > Network Address Recovery (This pings all IP address ranges > that you tell it > on a predetermined regular period (default 4 Hours), and > reports on the last > time an IP address was seen on the network) > There is a sample screen shot @ > http://solarwinds.net/Tools/Network_Discovery/Network_Address_ > Recovery/NetAd > Rec-1.gif I tested this, it looked quite good, but it's insistence at pinging things was annoying. > DHCP Scope Monitor (Requires Micro$soft DHCP and SNMP with > obviously NOT > public as the community string) Eeek. That would be interesting. Cheers and thanx. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IP Address Management software.
by Steve Lang 02 Aug '01

02 Aug '01

Hiya all. 'Been lurking here for a while now, and actually have something worth saying now! I'm looking into IP Address Management packages. I've grazed through google, and a few others, and found pointers to many. It seems that there are a few packages that purport to allow people to manage IP Address space, but many of them focus on the integration of DHCP/DNS. Now, for what I'm after at the moment, this isn't an issue, and all I really want is something that can document allocations and what they're used for. There are some packages that don't exist now, and a couple that have changed hands within the last few years. An understanding of VLSM/CIDR etc. is required, although maybe not an understanding, but an allowance to docuement super/subnets. What do you, the contributors to this list use? And yes, I've done the spreadsheet thing to death... Cheers - -------------------------------------------------------------------------- Steve Lang Telephone: +64-9-309-7918 Consultant DDI: +64-9-307-5584 Optimation New Zealand Limited. Mobile: +64-25-864-653 P.O.Box 106104 Fax: +64-9-309-7919 Auckland E-mail: steve.lang(a)optimation.co.nz New Zealand Web: www.optimation.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4