October 2001 - Test - lists.nanog.org

whois.ra.net
by Tatsuya Kawasaki 31 Oct '01

31 Oct '01

whois server on RA.NET is not working .. it does not look like DNS update correctly.. > set q=SOA > ra.net Server: auth2.xx.xx.xx Address: 210.xx.xx.xx *** xx.xx.xx.xx can't find ra.net: Non-existent host/domain Default Server: DNS.MERIT.NET Address: 198.108.1.42 > set q=SOA > ra.net Server: DNS.MERIT.NET Address: 198.108.1.42 ra.net origin = dns.merit.net mail addr = dns.merit.net serial = 200008040 refresh = 28800 (8H) retry = 14400 (4H) expire = 2419200 (4W) minimum ttl = 1200 (20M) ra.net nameserver = dns.merit.net ra.net nameserver = dns2.merit.net ra.net nameserver = dns3.merit.net dns.merit.net internet address = 198.108.1.42 dns2.merit.net internet address = 198.109.36.3 dns3.merit.net internet address = 198.108.130.5 I can use "whois.radb.net" though... Tatsuya /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ Tatsuya Kawasaki Allegiance Telecom Unlock the Power of the Internet http://www.kivex.com Phone 301.215.6777 Fax 301.215.5991 Affiliation given for identification not representation /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

2 1

Nimda.E = New Worm Request for Trace or Log
by Murphy, Brennan 31 Oct '01

31 Oct '01

If you have a sniffer trace file or a log of the activity of the new Nimda.E worm that has begun spreading in APAC, would you kindly send me an email? From those that reply, I can pick one or two to request they send them to me. (saves me from getting 100 emails with logs/traces in them) The new worm is reported here: http://www.zdnet.com/zdnn/stories/news/0,4586,5098988,00.html As this article indicates, the fixes for the original Nimda should work for this as well. Nonetheless, I'm still looking for a trace of it. Thanks!! -BM

1 0

Re: Contact for Yahoo postmaster ?
by miquels＠cistron-office.nl 30 Oct '01

30 Oct '01

In article <cistron.9r9ipi$kov$1(a)ncc1701.cistron.net>, Miquel van Smoorenburg <miquels(a)cistron-office.nl> wrote: >Does anyone know who to contact if you've been blacklisted >by the Yahoo SMTP servers? > ># nc -s195.64.68.40 203.199.70.34 smtp >553 Mail from 195.64.68.40 not allowed - user complaints of spam from this ip > >I tried postmaster(a)yahoo.com but got no reply. > >Weird that a mailservice this big blacklists people without giving >them advance notice and without reading postmaster(a)yahoo.com .. Right, I've tried postmaster(a)yahoo.com, abuse(a)yahoo.com, tech-contact(a)yahoo-inc.com. I got an auto-reply from the latter two, but that's all. Been blacklisted for a week now I guess, without any reason I know of. If someone from Yahoo reads this please contact me at postmaster(a)cistron.nl Mike. -- "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former" -- Albert Einstein.

3 2

New Alert :: Whens the 'Net the target?
by Eric Germann 30 Oct '01

30 Oct '01

Do you think there will be an Internet component to one of these, someday? http://www.msnbc.com/news/633205.asp ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45801 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "It is so easy to miss pretty trivial solutions to problems deemed complicated. The goal of a scientist is to find an interesting problem, and live off it for a while. The goal of an engineer is to evade interesting problems :)" -- Vadim Antonov <avg(a)kotovnik.com> on NANOG

6 7

Re: kornet.net abuse desk is mailing out W32.Nimda.E@mm worm
by Steven M. Bellovin 30 Oct '01

30 Oct '01

In message <195358945566.20011030133637(a)conti.nu>, Kai Schlichting writes: > >If you or your staff have dealt with kornet.net (a Korean ISP belonging >to Korean Telecom), and specifically abuse(a)kornet.net in the past, beware: >It seems that they've been overrun by the brand-spanking-new W32.Nimda.E@mm >worm (**) sometimes late last night. > >Specific case in hand: yesterday at 9:40pm EST, I received a mail >with a Subject: line of an UNRELATED abuse issue (hello MFNX/XO/ >Above.net :) that contains a MIME attachment with an auto-playing >"sound file" of sample.exe , openened in an <iframe> of your favorite >Microsoft email client. Source IP of the mailing : 210.222.17.36 (/24). Note, however, that the From: line on these Nimda variants is also forged; see http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html for details. (I received several messages saying that some mail I sent was infected with Nimda.E. This struck me as quite improbable, since I use NetBSD for all my email and other real work.) --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

Re: Re[2]: NOC Question
by Gregory Urban 30 Oct '01

30 Oct '01

At 12:36 AM 10/19/2001, you wrote: >I'd like to see how many folks have the top-end functional NOCs as opposed >to fishbowls for customers to gawk at like a zoo. Low, indirect lighting. >Sound and light absorbing materials everywhere. Quiet fans in the >ceiling. Enough space between NOC techs so that phone conversations don't >interfere with each other. etc. > >That's opposed to NOCs with white, hard, sound and light reflecting >materials, bright flourscent lighting, closely packed people and the clear >window to look in from the outside creating the fishbowl effect. > >It's hard to tell, but the AT&T NOC in the link given earlier seems to >have the characteristics of the first kind, but the picture's not too >detailed. Any good, detailed pictures of a top-end functional NOC with >said characteristics? > >scott Talk about a fishbowl, the AT&T NOC has an overlook area for customers complete with stadium seating! Greg U

1 0

kornet.net abuse desk is mailing out W32.Nimda.E@mm worm
by Kai Schlichting 30 Oct '01

30 Oct '01

If you or your staff have dealt with kornet.net (a Korean ISP belonging to Korean Telecom), and specifically abuse(a)kornet.net in the past, beware: It seems that they've been overrun by the brand-spanking-new W32.Nimda.E@mm worm (**) sometimes late last night. Specific case in hand: yesterday at 9:40pm EST, I received a mail with a Subject: line of an UNRELATED abuse issue (hello MFNX/XO/ Above.net :) that contains a MIME attachment with an auto-playing "sound file" of sample.exe , openened in an <iframe> of your favorite Microsoft email client. Source IP of the mailing : 210.222.17.36 (/24). Mental note to all abuse desk personnel and publicly visible contacts: do not use Microsoft, or any other widely used piece of software to read and process your mail. Auto-adding mail senders to your Outlook addressbook could be considered a deadly sin. Anti-Virus software with definitions older than 24 hrs seem to be a real hazard, too. bye,Kai (**) http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.e@mm.html

1 0

FBI is at it again
by Larry Diffey 30 Oct '01

30 Oct '01

Per the following article: http://www.foxnews.com/story/0,2933,37203,00.html it appears as if the FBI now wants to route ALL Internet traffic through it's central servers!!!! What gall!! What nerve!!!! Now, for all of you who said, "Hey, I'm not doing anything wrong, let the FBI monitor what it wants to." can go shove hot spikes up your nose. I don't think the FBI really wants to control the Internet, they want to destabilize it. As tyranny approaches the only thing more dangerous than an armed populace is an informed one. If they can monitor all the traffic, they can certainly control it. The ISP's (whatever those are) need to collectively tell the FBI to go jump off a bridge. Information campaigns need to be sent to the customers to alert them of the potential loss of civil liberties. I'm gonna stop before I say something that will get me arrested. Regards, Larry Diffey

12 11

RE: Fwd: Re: Digital Island sponsors DoS attempt?
by Scotty Allen 30 Oct '01

30 Oct '01

> I have no objection if someone who honestly saw a message I > wrote and > thought I'd be suitable for a particular job emails me asking if I'm > interested. However, the same email would be bulk if sent to everyone who > posts to NANOG, even if says, "I saw your post about "Re: Fwd: > Re: Digital > Island sponsors DoS attempt" and thought you might be interested > in buying > our premium fishing worms". A corallary to this is the dreaded "I saw your resume on <insert job board here> and so you must be interested in our offer of <insert job hunting service here>." The spammer would argue they are in the right, in that as part of posting a resume, one is expecting, and inviting responses. However, I would argue that just because I post my resume, doesn't mean I'm interested in anything other than serious job offers. I dealt with a similar situation from the abuse desk end, in which a client was doing searches of resumes on job boards for a given skill set, and then mass mailing them with a specific job offer that centered around that skill set. It was a tough issue to resolve, because on the one hand, from our client's perspective, he was contacting people he thought would be genuinely interested. And yet, from the recipients perspective, since it wasn't directed straight to them, it could be considered UBE. Moral of the story is, it came down to a very fine line of what does "solicited" mean? We ended up comprimising that he would fully disclose where he got his email addresses from, and why he was sending the email, which all but competely eliminated complaints. Scotty Allen

1 0

Re: New Alert :: Whens the 'Net the target?
by Jeffrey Meltzer 29 Oct '01

29 Oct '01

My bad, has been off of mx10 forever, guess I forgot to take off of mx20 Jeff On Mon, Oct 29, 2001 at 04:28:59PM -0800, Derek J. Balling typed: > Would be much useful if you would disable orbs.org checking since > it's returning random false-positives since it went out of business > two months ago: > > ----- Transcript of session follows ----- > ... while talking to mx10.exobit.org.: > >>> DATA > <<< 421 Error: timeout exceeded > ... while talking to mx20.exobit.org.: > >>> DATA > <<< 554 Service unavailable; [64.71.143.244] blocked using relays.orbs.org > 554 5.0.0 Service unavailable > <<< 554 Error: no valid recipients > > Hard to confirm the signup, if you won't accept the confirmations... > > D > > At 6:38 PM -0500 10/29/01, Jeffrey Meltzer wrote: > >(no offense to the poster, someone was bound to post..) > > > >I see this thread getting long and entirely off topic for nanog. I've > >setup a list for discussions such as this, and any type of physical attack > >(although I guess regular DOS could be on topic) at the > >internet infrastruture, as this could go on for a while... > > > >http://www.exobit.org/mailman/listinfo/net-attacks > >for info. > > > >Let's try and keep nanog more operational? > > > >Jeff > > > >On Mon, Oct 29, 2001 at 06:17:09PM -0500, Eric Germann typed: > >> Do you think there will be an Internet component to one of these, someday? > >> > >> http://www.msnbc.com/news/633205.asp > >> > >> > >> ========================================================================== > >> Eric Germann CCTec > >> ekgermann(a)cctec.com Van Wert OH 45801 > >> http://www.cctec.com Ph: 419 968 2640 > >> Fax: 603 825 5893 > >> > >> "It is so easy to miss pretty trivial solutions to problems deemed > >> complicated. The goal of a scientist is to find an interesting problem, > >> and live off it for a while. The goal of an engineer is to evade > >> interesting problems :)" -- Vadim Antonov <avg(a)kotovnik.com> on NANOG > >> > >> > >> > > > -- > +---------------------+-----------------------------------------+ > | dredd(a)megacity.org | "Thou art the ruins of the noblest man | > | Derek J. Balling | That ever lived in the tide of times. | > | | Woe to the hand that shed this costly | > | | blood" - Julius Caesar Act 3, Scene 1 | > +---------------------+-----------------------------------------+ >

1 0