- NZNOG - lists.nznog.org

None
by Ivan Walker 19 Jul '01

19 Jul '01

subscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red
by Thomas Salmen 19 Jul '01

19 Jul '01

Niiiice... [root(a)proxy1 /root]# grep -c default.ida access.log 721522 [root(a)proxy2 /root]# grep -c default.ida access.log 717971 Cheers, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Update to "Code Red" Worm. Its a date bomb, not time.
by Greg Clare 19 Jul '01

19 Jul '01

>-----Original Message----- >From: Marc Maiffret [mailto:marc(a)eeye.com] >Sent: Friday, 20 July 2001 8:55 a.m. >To: BUGTRAQ >Subject: Update to "Code Red" Worm. Its a date bomb, not time. > > >Thanks to Eric from Symantec for tossing us a note about the >worm being Date >based and not Time based. > >We made an error in our last analysis and said the worm would start >attacking whitehouse.gov based on a certain time. In reality >its based on a >date (the 20th UTC) which is tomorrow. > >If the worm infects your system between the 1st and the 19th >it will attempt >to deface the infected servers web page or try to propogate >itself to other >systems. On the 20th all infected threads will attempt to attack >www.whitehouse.gov. This seems to continue until the worm is >removed from >the infected system. > >Any new infection that happens between the 20th and 28th will >most likely be >someone "hand infecting" your system as all other worms should >be attacking >whitehouse.gov. If for some reason you are infected between >the 20th and the >28th then the worm will begin attacking whitehouse.gov without >trying to >infect other systems. This attack will continue indefinitly. > >The following are rough numbers, but we felt that it was important to >illustrate the affects this worm can _possibly_ have. > >The worm has a timeline like this: > >day of the month: >1-19: infect other hosts using the worm >20-27: attack whitehouse.gov forever >28-end of month: eternal sleep > >Presumably, this could restart at any point in a new month again. > >Also, some stats for the attack: > >Each infection has 100 threads >Each thread is going to send about 100k, a byte at a time, >which means you >have a (40 for ip + 1 for each byte) which means you have 4.1 >megs of data >per thread >100 threads * 4.1megs = 410 Megabytes >This will be repeated again every 4.5 hours or so > >Remember, each host can be infected multiple times, meaning >that a single >host can send 410MB * # of infections. > >We have had reports between 15 thousand and 196 thousand unique hosts >infected with the "Code Red" worm. However, there has been >cross infection >and we have heard reports of at least 300+ thousand >infections/instances >(machines with multiple infections etc..) of this worm. > >If there are 300 thousand infections then that means you have >(300,000 * 410 >megabytes) that is going to be attempted to be flooded against >whitehouse.gov every 4 and a half hours. If this is true and >the worm "works >as advertised" then the fact that whitehouse.gov goes offline >is only the >begining of what _can_ possibly happen... > >---- > >I am actually writing this part of the eMail about 45 minutes after the >first part because our Internet connection here in california >has been going >up and down. We have also heard reports of internet >connectivity going down >in parts of northern california and new york. > >Signed, >eEye Digital Security >T.949.349.9062 >F.949.349.9538 >http://eEye.com/Retina - Network Security Scanner >http://eEye.com/Iris - Network Traffic Analyzer >http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Full analysis of the .ida "Code Red" worm.
by Tony Wicks 19 Jul '01

19 Jul '01

-----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, July 20, 2001 10:12 AM To: tony.wicks(a)telstrasaturn.co.nz Subject: RE: Full analysis of the .ida "Code Red" worm. Well, Tony, to be quite frank, you annoy me even more. Who the fuck appointed you as the content-cop on NZNOG, and told you to stalk me with rude replies each time I post something? Nobody else complains about my posts, and I bet you haven't got the courage to be rude to anyone else. -- Juha :: -----Original Message----- :: From: Tony Wicks [mailto:tony.wicks(a)telstrasaturn.co.nz] :: Sent: Friday, 20 July 2001 10:07 :: To: Juha Saarinen :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: Well, it's a bit rich, you posting back to the list telling :: me to cut a few :: lines out of a posting when you send so many useless posts :: there. Quite :: frankly, that annoyed me quite a bit ! :: :: -----Original Message----- :: From: Juha Saarinen [mailto:juha(a)saarinen.org] :: Sent: Friday, July 20, 2001 9:59 AM :: To: tony.wicks(a)telstrasaturn.co.nz; nznog(a)list.waikato.ac.nz :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: Don't exaggerate Tony. :: :: -- :: :: Juha :: :: :: -----Original Message----- :: :: From: Tony Wicks [mailto:tony.wicks(a)telstrasaturn.co.nz] :: :: Sent: Friday, 20 July 2001 09:57 :: :: To: Juha Saarinen; nznog(a)list.waikato.ac.nz :: :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: :: :: :: Ok, tell you what, I'll trim my posts if you cut your posts :: :: to just relevant :: :: stuff, not 10-20 mails a day of off topic drivel, hows that :: :: for a deal. :: :: :: --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

SPAM/SCAM alert
by Michael Newbery 19 Jul '01

19 Jul '01

This piece of ordure just showed up in my mailbox. Just a heads-up in case anyone hasn't already seen it and might decide to alert the customers. Now, where did I put that nuclear weapon? At 5:34 PM +0100 19/7/01, <webhosting(a)associate.co.uk> wrote: >Received: from moonof.saturn.co.nz > (rata.saturn.co.nz [172.20.18.220]) > by wlg-gwia-nw-01.saturn.co.nz; Fri, 20 Jul 2001 04:44:56 +1200 >Received: from cmailg6.svr.pol.co.uk (cmailg6.svr.pol.co.uk [195.92.195.176]) > by moonof.saturn.co.nz (Postfix) with ESMTP id A3A629C12 > for <michaeln(a)saturn.co.nz>; Fri, 20 Jul 2001 04:34:49 +1200 (NZST) >Received: from harrya.fsnet.co.uk ([217.134.134.196] helo=andrewal) > by cmailg6.svr.pol.co.uk with smtp (Exim 3.13 #0) > id 15NGl1-0002jE-00 > for michaeln(a)saturn.co.nz; Thu, 19 Jul 2001 17:34:35 +0100 >To: <michaeln(a)saturn.co.nz> >From: <webhosting(a)associate.co.uk> >Subject: notice from your webhost >MIME-Version: 1.0 >Content-Type: text/plain; charset=unknown-8bit >Message-Id: <E15NGl1-0002jE-00.2001-07-19-17-34-35(a)cmailg6.svr.pol.co.uk> >Date: Thu, 19 Jul 2001 17:34:35 +0100 > ><x-charset unknown-8bit> > >This email is being sent to you on behalf of your current webspace provider. >This message is not a spam or junk email, your email address was >supplied to WebHosting.com >You will not receive any more messages from WebHosting.com this is a >one time special offer notice. > >WebHosting.com is offering a selected number of webhost's member's >the following special offer. This offer is not available on our >website at www.webhosting.com or anywhere else, this is a special >offer and is valid only for a limitied time. Read on to learn more >about this amazing offer. > >For only $6.25 (one time fee) you can get: > >> 500mb webspace >> unlimited pop3 email addresses >> cgi-bin >> full ftp access >> php, ssi, my-sql, asp support >> mySQL database >> FREE DOMAIN REGISTRATION (.com .net .org) >> unlimited bandwidth >> miva merchant account >> secure server for transactions >> accept credit cards >> 24hour technical support > >You did read it right, all this will only cost you only $6.25. There >are no monthly fees or any other costs. You are probably wondering >how WebHosting.com can offer all this for the very low price of only >$6.25, the answer is that WebHosting.com will make a lot of revenue >from extra webspace charges - people wishing to have more than 500mb >can pay $10 per 10mb per month. > >If you would like to receive this excellent offer all you have to do >is send your details to the following email address and your >username and password will be emailed to you within 5 business days. >Then you will be able to login at the members area of WebHosting.com >and configure your account (add domains, setup scripts etc.). > >Please send all of the following details: > >Your Full Name >Your Full Address >Your Phone Number >Your Email Address >Your Credit Card Number >Your Credit Card Expiry Date >Your Credit Card Type (eg. visa, mastercard etc.) > >Send all of the above to webhosting(a)associate.co.uk > > > > >Thank you and I hope you enjoy this very special offer > >John Simmons >Head of Special Promotions, Webhosting.com > >------------------------------------------------------------------------------------- >WebHosting.com is a member of the CNS International Internet >Businesses Association > > ></x-charset> -- Michael Newbery Technical Specialist TelstraSaturn Limited Tel: +64-4-939 5102 Mobile: +64-29-939 5102 Fax: +64-4-922 8401 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Problems accessing sites in china
by Lin Nah 18 Jul '01

18 Jul '01

HI all I wonder if anyone here has had complains from their customers/helpdesk regarding inability to access certain chinese websites. For example the last 5 hops of a trace to www.china.com shows it disappearing after 201.176.155.238 15 hkt.ser4-0.core1.sun.cais.net (63.216.17.73) 245.372 ms 240.922 ms 237.96 0 ms 16 202.84.249.29 (202.84.249.29) 236.565 ms 235.41 ms 234.18 ms 17 207.176.97.134 (207.176.97.134) 245.263 ms 235.18 ms 238.485 ms 18 f5-1.tmh12.hkt.net (205.252.128.238) 245.80 ms 239.694 ms 243.223 ms 19 210.176.155.238 (210.176.155.238) 244.516 ms 246.827 ms 235.416 ms 20 * * * There's also been problems with some other sites ( can't remember names but perhaps one of them is cn.yahoo.com) Any ideas? regards Lin --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

RE: IPv6...Fact or Fiction?
by Gavin Cato 18 Jul '01

18 Jul '01

>> NAT is a broken idea, as are firewalls. Just because it works, >> doesn't change this. I wouldn't call it broken. A band-aid solution perhaps but not broken. It does what it intended to do quite well. Gav --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 14

This list, or an alternative? was RE: Julian Angelo - Conclusion
by Frank March 18 Jul '01

18 Jul '01

I am not a network operative, yet I lurk here (with intent, since I v occasionally post). I have always considered that off-topic posts (like, I suppose, this one) come into the permissible area, as allowed for in the mention of beer in the AUP. I have always had an excellent range of helpful responses from NZNOG subscribers when I have posed policy related questions to this list even though they are unrelated to beer. I find being on this list extremely useful. At the same time, a point made in another post in the parent thread by Matt Camp about a non-operational companion list could be considered although I dont think the noise level is that serious. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 > -----Original Message----- > From: Dean Pemberton [SMTP:dean(a)flatnet.gen.nz] > Sent: Thursday, 19 July 2001 11:43 > To: Matt Camp > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: Julian Angelo - Conclusion > > On Thu, Jul 19, 2001 at 11:22:41AM +1200, Matt Camp wrote: > > > > > thirteen in the second. Removing from the count people I believe not > to > > > be staff of network operators, and the subscriber who expressed both > > > > Hrm... good point here. I know I don't have an official sig on this > email > > address, so might have been placed in the 'not a network op' basket > > here... yet I am. > > And I'm not - if anyone thinks that this makes me unsuitable for inclusion > by the 'network operator elite' then let me know and I'll unsubscribe. > > > Dean > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Could this be why your 827s are retraining?
by Juha Saarinen 18 Jul '01

18 Jul '01

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121relnt /800/800yb/rn800yb.htm Resolved Caveats for Release 12.1(5)YB1 This section describes possibly unexpected behavior by software releases prior to Release 12.1(5)YB1 that have been resolved in Release 12.1(5)YB1 and above. CSCdt19816 A router retrains when an LOM is detected-a critical condition message is sent out, resulting in an unnecessary reboot. A LOM alone is not sufficient to require a critical condition message or router reset. This problem is fixed in Cisco IOS Software Release 12.1(5)YB1 My version is: ROM: System Bootstrap, Version 12.1(1r)XB1, RELEASE SOFTWARE (fc1) ROM: C820 Software (C820-Y6-M), Version 12.1(5)YC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

unsubscribe nznog
by Melanie McAllister 18 Jul '01

18 Jul '01

-----Original Message----- From: James Tyson [mailto:james(a)samizdat.co.nz] Sent: Thursday, 19 July 2001 10:13 a.m. To: Juha Saarinen Cc: 'Simon Allard'; 'James Tyson'; nznog(a)list.waikato.ac.nz Subject: RE: IPv6...Fact or Fiction? > Yes, yes, but what does that mean? Details, man, details. ;-) > > I have found that with either the Nokia MW1122 and the Cisco 827 plugged > in, my Jetstream connection suffers from "micro outages", usually once a > day. It'd be interesting to discover if these outages are caused by the > adapter or by a fault/flaw in Jetstream. > > Here's what the 827 logs: > > Jul 12 03:00:16 router 23: Jul 12 03:00:16.373 NZ: %LINK-3-UPDOWN: > Interface ATM0, changed state to down > Jul 12 03:00:16 router 24: Jul 12 03:00:16.381 NZ: %LINK-3-UPDOWN: > Interface Virtual-Access1, changed state to down <snip /> Juha, Try "debug atm errors" and email me the output - I'll bet your getting the same thing as me. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0