- NZNOG - lists.nznog.org

RE: Full analysis of the .ida "Code Red" worm - Attacks stop
by Lindsay Druett 19 Jul '01

19 Jul '01

www.microsoft.com got hit today. I went to their site and had the message "Hacked by Chinese" in red letters. Pity, next time I logged in, I got the normal web page, a bit disappointing.... But I logged in again later, in the same web page, and got the "Hacked by Chinese", so it must be only a few of their servers. So much for "round robin" load sharing, they should be using a Cisco content switch. After 6days The attacks have stoped hitting my server in the past 10 minutes ... Who did what to whom... where is the corpse.... Michael --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Help with survey needed
by Frank March 19 Jul '01

19 Jul '01

I have been asked to assist with recruitment for an online survey of ISPs and IT companies in New Zealand. The survey is being conducted by the Information Technology Group at the Center for International Development, Harvard University in conjunction with the World Economic Forum and will be used to compile the Global Information Technology Readiness Report (GITRR). The survey for Internet Service Providers (ISPs) can be found at: http://www.cid.harvard.edu/ciditg/isp The survey for other kinds of IT companies can be found at: http://www.cid.harvard.edu/ciditg/it It is suggested that the survey should be completed by someone in a senior management position in your company or organisation. If you do not feel you 'qualify' please pass this on in your organisation to someone who does. I am distributing this to the NZNOG, InternetNZ members, and GOVIS email lists (apologies for duplications). Please feel free to further distribute to other contacts if you think it would be useful. If you want to find out more, I have appended below the unexpurgated and (largely) unedited text sent to me by Indran Ratnathicam, who is in charge of the survey. Thank you Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 <from Indran> You are invited to become a collaborator and participant in a major research project, the Global Information Technology Readiness Report (GITRR). The GITRR, a new venture between Harvard University and the World Economic Forum, aims to make an important contribution to the understanding of the New Economy and global IT usage. This report will be published in the Fall 2001, and will assess the global IT situation for nearly 100 countries, including New Zealand. The GITRR will provide: · A background for policy discussions by your government and international bodies that will influence the IT and economic development in your country, including your company's activities. · A clearly identified list of your country's relative IT strengths that may spur investment or become a source of competitive advantage in your industry or region. · A clearly identified list of your country's areas for IT development, which can be used to focus future development initiatives by both the public and private sectors. · A tool for international IT companies to increase their understanding of local markets, their opportunities and their challenges. As an IT leader of New Zealand, you are in a unique position to accurately portray where your country stands with regard to the adoption and use of IT within the global context. Your cooperation is essential in adding value to the GITRR and in guaranteeing inclusion of your country in the Report. All you need to do is fill out an online survey. The survey for Internet Service Providers (ISPs) can be found at: http://www.cid.harvard.edu/ciditg/isp The survey for other kinds of IT companies can be found at: http://www.cid.harvard.edu/ciditg/it It will take no more than 30 min of your time to complete and you will not have to necessarily stay logged on to the Internet while you are filling it out. Please fill out the survey by August 3, 2001. If you have additional comments/ queries, please do not hesitate to get in touch with me at Indran_Ratnathicam(a)ksg.harvard.edu. Please rest assured that individual questionnaires remain strictly confidential. Thank you in advance for taking the time to complete this survey. With best regards, Indran Ratnathicam Global IT Readiness Report Information Technologies Group Center for International Development at Harvard University Further details about the Global IT Readiness Report can be found at: http://www.cid.harvard.edu/ciditg/gitrr/ PS: If you are aware of other IT leaders in your country please direct them to the survey --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

None
by Ivan Walker 19 Jul '01

19 Jul '01

subscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red
by Thomas Salmen 19 Jul '01

19 Jul '01

Niiiice... [root(a)proxy1 /root]# grep -c default.ida access.log 721522 [root(a)proxy2 /root]# grep -c default.ida access.log 717971 Cheers, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Update to "Code Red" Worm. Its a date bomb, not time.
by Greg Clare 19 Jul '01

19 Jul '01

>-----Original Message----- >From: Marc Maiffret [mailto:marc(a)eeye.com] >Sent: Friday, 20 July 2001 8:55 a.m. >To: BUGTRAQ >Subject: Update to "Code Red" Worm. Its a date bomb, not time. > > >Thanks to Eric from Symantec for tossing us a note about the >worm being Date >based and not Time based. > >We made an error in our last analysis and said the worm would start >attacking whitehouse.gov based on a certain time. In reality >its based on a >date (the 20th UTC) which is tomorrow. > >If the worm infects your system between the 1st and the 19th >it will attempt >to deface the infected servers web page or try to propogate >itself to other >systems. On the 20th all infected threads will attempt to attack >www.whitehouse.gov. This seems to continue until the worm is >removed from >the infected system. > >Any new infection that happens between the 20th and 28th will >most likely be >someone "hand infecting" your system as all other worms should >be attacking >whitehouse.gov. If for some reason you are infected between >the 20th and the >28th then the worm will begin attacking whitehouse.gov without >trying to >infect other systems. This attack will continue indefinitly. > >The following are rough numbers, but we felt that it was important to >illustrate the affects this worm can _possibly_ have. > >The worm has a timeline like this: > >day of the month: >1-19: infect other hosts using the worm >20-27: attack whitehouse.gov forever >28-end of month: eternal sleep > >Presumably, this could restart at any point in a new month again. > >Also, some stats for the attack: > >Each infection has 100 threads >Each thread is going to send about 100k, a byte at a time, >which means you >have a (40 for ip + 1 for each byte) which means you have 4.1 >megs of data >per thread >100 threads * 4.1megs = 410 Megabytes >This will be repeated again every 4.5 hours or so > >Remember, each host can be infected multiple times, meaning >that a single >host can send 410MB * # of infections. > >We have had reports between 15 thousand and 196 thousand unique hosts >infected with the "Code Red" worm. However, there has been >cross infection >and we have heard reports of at least 300+ thousand >infections/instances >(machines with multiple infections etc..) of this worm. > >If there are 300 thousand infections then that means you have >(300,000 * 410 >megabytes) that is going to be attempted to be flooded against >whitehouse.gov every 4 and a half hours. If this is true and >the worm "works >as advertised" then the fact that whitehouse.gov goes offline >is only the >begining of what _can_ possibly happen... > >---- > >I am actually writing this part of the eMail about 45 minutes after the >first part because our Internet connection here in california >has been going >up and down. We have also heard reports of internet >connectivity going down >in parts of northern california and new york. > >Signed, >eEye Digital Security >T.949.349.9062 >F.949.349.9538 >http://eEye.com/Retina - Network Security Scanner >http://eEye.com/Iris - Network Traffic Analyzer >http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Full analysis of the .ida "Code Red" worm.
by Tony Wicks 19 Jul '01

19 Jul '01

-----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, July 20, 2001 10:12 AM To: tony.wicks(a)telstrasaturn.co.nz Subject: RE: Full analysis of the .ida "Code Red" worm. Well, Tony, to be quite frank, you annoy me even more. Who the fuck appointed you as the content-cop on NZNOG, and told you to stalk me with rude replies each time I post something? Nobody else complains about my posts, and I bet you haven't got the courage to be rude to anyone else. -- Juha :: -----Original Message----- :: From: Tony Wicks [mailto:tony.wicks(a)telstrasaturn.co.nz] :: Sent: Friday, 20 July 2001 10:07 :: To: Juha Saarinen :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: Well, it's a bit rich, you posting back to the list telling :: me to cut a few :: lines out of a posting when you send so many useless posts :: there. Quite :: frankly, that annoyed me quite a bit ! :: :: -----Original Message----- :: From: Juha Saarinen [mailto:juha(a)saarinen.org] :: Sent: Friday, July 20, 2001 9:59 AM :: To: tony.wicks(a)telstrasaturn.co.nz; nznog(a)list.waikato.ac.nz :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: Don't exaggerate Tony. :: :: -- :: :: Juha :: :: :: -----Original Message----- :: :: From: Tony Wicks [mailto:tony.wicks(a)telstrasaturn.co.nz] :: :: Sent: Friday, 20 July 2001 09:57 :: :: To: Juha Saarinen; nznog(a)list.waikato.ac.nz :: :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: :: :: :: Ok, tell you what, I'll trim my posts if you cut your posts :: :: to just relevant :: :: stuff, not 10-20 mails a day of off topic drivel, hows that :: :: for a deal. :: :: :: --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

SPAM/SCAM alert
by Michael Newbery 19 Jul '01

19 Jul '01

This piece of ordure just showed up in my mailbox. Just a heads-up in case anyone hasn't already seen it and might decide to alert the customers. Now, where did I put that nuclear weapon? At 5:34 PM +0100 19/7/01, <webhosting(a)associate.co.uk> wrote: >Received: from moonof.saturn.co.nz > (rata.saturn.co.nz [172.20.18.220]) > by wlg-gwia-nw-01.saturn.co.nz; Fri, 20 Jul 2001 04:44:56 +1200 >Received: from cmailg6.svr.pol.co.uk (cmailg6.svr.pol.co.uk [195.92.195.176]) > by moonof.saturn.co.nz (Postfix) with ESMTP id A3A629C12 > for <michaeln(a)saturn.co.nz>; Fri, 20 Jul 2001 04:34:49 +1200 (NZST) >Received: from harrya.fsnet.co.uk ([217.134.134.196] helo=andrewal) > by cmailg6.svr.pol.co.uk with smtp (Exim 3.13 #0) > id 15NGl1-0002jE-00 > for michaeln(a)saturn.co.nz; Thu, 19 Jul 2001 17:34:35 +0100 >To: <michaeln(a)saturn.co.nz> >From: <webhosting(a)associate.co.uk> >Subject: notice from your webhost >MIME-Version: 1.0 >Content-Type: text/plain; charset=unknown-8bit >Message-Id: <E15NGl1-0002jE-00.2001-07-19-17-34-35(a)cmailg6.svr.pol.co.uk> >Date: Thu, 19 Jul 2001 17:34:35 +0100 > ><x-charset unknown-8bit> > >This email is being sent to you on behalf of your current webspace provider. >This message is not a spam or junk email, your email address was >supplied to WebHosting.com >You will not receive any more messages from WebHosting.com this is a >one time special offer notice. > >WebHosting.com is offering a selected number of webhost's member's >the following special offer. This offer is not available on our >website at www.webhosting.com or anywhere else, this is a special >offer and is valid only for a limitied time. Read on to learn more >about this amazing offer. > >For only $6.25 (one time fee) you can get: > >> 500mb webspace >> unlimited pop3 email addresses >> cgi-bin >> full ftp access >> php, ssi, my-sql, asp support >> mySQL database >> FREE DOMAIN REGISTRATION (.com .net .org) >> unlimited bandwidth >> miva merchant account >> secure server for transactions >> accept credit cards >> 24hour technical support > >You did read it right, all this will only cost you only $6.25. There >are no monthly fees or any other costs. You are probably wondering >how WebHosting.com can offer all this for the very low price of only >$6.25, the answer is that WebHosting.com will make a lot of revenue >from extra webspace charges - people wishing to have more than 500mb >can pay $10 per 10mb per month. > >If you would like to receive this excellent offer all you have to do >is send your details to the following email address and your >username and password will be emailed to you within 5 business days. >Then you will be able to login at the members area of WebHosting.com >and configure your account (add domains, setup scripts etc.). > >Please send all of the following details: > >Your Full Name >Your Full Address >Your Phone Number >Your Email Address >Your Credit Card Number >Your Credit Card Expiry Date >Your Credit Card Type (eg. visa, mastercard etc.) > >Send all of the above to webhosting(a)associate.co.uk > > > > >Thank you and I hope you enjoy this very special offer > >John Simmons >Head of Special Promotions, Webhosting.com > >------------------------------------------------------------------------------------- >WebHosting.com is a member of the CNS International Internet >Businesses Association > > ></x-charset> -- Michael Newbery Technical Specialist TelstraSaturn Limited Tel: +64-4-939 5102 Mobile: +64-29-939 5102 Fax: +64-4-922 8401 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Problems accessing sites in china
by Lin Nah 18 Jul '01

18 Jul '01

HI all I wonder if anyone here has had complains from their customers/helpdesk regarding inability to access certain chinese websites. For example the last 5 hops of a trace to www.china.com shows it disappearing after 201.176.155.238 15 hkt.ser4-0.core1.sun.cais.net (63.216.17.73) 245.372 ms 240.922 ms 237.96 0 ms 16 202.84.249.29 (202.84.249.29) 236.565 ms 235.41 ms 234.18 ms 17 207.176.97.134 (207.176.97.134) 245.263 ms 235.18 ms 238.485 ms 18 f5-1.tmh12.hkt.net (205.252.128.238) 245.80 ms 239.694 ms 243.223 ms 19 210.176.155.238 (210.176.155.238) 244.516 ms 246.827 ms 235.416 ms 20 * * * There's also been problems with some other sites ( can't remember names but perhaps one of them is cn.yahoo.com) Any ideas? regards Lin --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

RE: IPv6...Fact or Fiction?
by Gavin Cato 18 Jul '01

18 Jul '01

>> NAT is a broken idea, as are firewalls. Just because it works, >> doesn't change this. I wouldn't call it broken. A band-aid solution perhaps but not broken. It does what it intended to do quite well. Gav --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 14

This list, or an alternative? was RE: Julian Angelo - Conclusion
by Frank March 18 Jul '01

18 Jul '01

I am not a network operative, yet I lurk here (with intent, since I v occasionally post). I have always considered that off-topic posts (like, I suppose, this one) come into the permissible area, as allowed for in the mention of beer in the AUP. I have always had an excellent range of helpful responses from NZNOG subscribers when I have posed policy related questions to this list even though they are unrelated to beer. I find being on this list extremely useful. At the same time, a point made in another post in the parent thread by Matt Camp about a non-operational companion list could be considered although I dont think the noise level is that serious. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 > -----Original Message----- > From: Dean Pemberton [SMTP:dean(a)flatnet.gen.nz] > Sent: Thursday, 19 July 2001 11:43 > To: Matt Camp > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: Julian Angelo - Conclusion > > On Thu, Jul 19, 2001 at 11:22:41AM +1200, Matt Camp wrote: > > > > > thirteen in the second. Removing from the count people I believe not > to > > > be staff of network operators, and the subscriber who expressed both > > > > Hrm... good point here. I know I don't have an official sig on this > email > > address, so might have been placed in the 'not a network op' basket > > here... yet I am. > > And I'm not - if anyone thinks that this makes me unsuitable for inclusion > by the 'network operator elite' then let me know and I'll unsubscribe. > > > Dean > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0