- Test - lists.nanog.org

Puerto Rico
by Mehmet Akcin 11 Oct '03

11 Oct '03

Anyone living in Puerto Rico (if they are getting this mail, they should be working for computer/internet related anyway) can contact me offlist please? thanks. Mehmet Akcin

1 0

contact at yahoo mail? (they think we're an open relay :< )
by Mark Jeftovic 10 Oct '03

10 Oct '03

Today our email forwarders started getting this from yahoo.com mail handlers: 553 Mail from 216.220.40.247 not allowed - VS99-IP1 deferred - see help.yahoo.com/help/us/mail/defer/defer-02.html (#5.7.1) Connection closed by foreign host. Which when you go look at that page basically tells you you're probably an open relay (which we're not), etc. Can any mail admins at Yahoo contact me offlist, or post what the restrictions are or at what levels this will kick in? -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 9

first Yahoo, now RoadRunner?
by Mark Jeftovic 10 Oct '03

10 Oct '03

rr.com blocking our netblock since this morning now.... 5.7.1 Mail Refused - 216.220.40 - See http://security.rr.com/mail_blocks.htm#security Anyone else? -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 10

The Earth's not slowing down fast enough to
by bmanning＠karoshi.com 10 Oct '03

10 Oct '03

> Date: Tue, 07 Oct 2003 23:33:45 -0700 > Subject: The Earth's not slowing down fast enough to suit Motorola > > Motorola reports that several GPS receivers in its Oncore line will > misdisplay the date on 28 Nov 2003 at midnight UTC. For a one-second window > the receivers will mistakenly report the date as 29 Nov instead of 28 Nov. > > Here's why. Every couple of years or so for the past three decades, the > International Earth Rotation Service has announced a leap-second because the > Earth is rotating slightly more slowly than an 86400-second day would > suggest. But since 1 Jan 1999, we've had an unusually long dry spell > without any leap seconds. The GPS week number in the UTC correction > parameter is 8 bits long, which allows for 256 weeks of unambiguous time > calculation. Until now this parameter has never rolled over, but because of > the dry spell 28 Nov will be exactly 256 weeks after the most recent leap > second, and the rollover will contribute to the bug. > <http://www.motorola.com/ies/GPS/docs_pdf/notification_oncore.pdf> > > Steve Allen writes in <http://www.ucolick.org/~sla/leapsecs/onlinebib.html> > that some JDAM smart bombs and other munitions are rumored to contain these > receivers. Anyone intending to use those weapons around the magic window > might want to reschedule their bombing runs for some other time. ... for all you NTP/GPS junkies out there... :) --bill

1 0

Re: RE: Finding clue at comcast.net
by Alan Spicer 10 Oct '03

10 Oct '03

>From: "Austad, Jay" <JAustad(a)temgweb.com> >Date: 2003/10/09 Thu AM 10:29:25 EDT >To: "'Howard C. Berkowitz'" <hcb(a)gettcomm.com>, nanog(a)merit.org >Subject: RE: Finding clue at comcast.net > > >Comcast's phone support department is the *worst*, WORST, I've ever dealt >with. I think they are outsourced, they have to go by a script, and many of >them probably hardly know what a computer even is. Once I called because of >a problem on their network, and I told the person on the phone that there >was a problem on their network, and I pinned it down to a couple of routers >where the problem may be, and she responded, very sternly, "Sir, WE DON'T >HAVE ANY ROUTERS" > >In any case, if you manage to get the call escalated a couple of times >(after lying about rebooting your computer 47 times), you'll get someone >good. Also, there are some good people who read this list. But calling >their phone support to get anything useful is like trying to squeeze blood >from a rock. > >-jay * You might want to try and Social Engineer this one a little bit. In your other email you had mentioned someone in their call center suggesting you call the local cable company about the server (or such). Now I'm not suggesting anyone lie ... or such a thing ... but say you called the local office on a cold sales call asking for the person that handles their data networking. As you work your way through that try to find out who is the Head Engineer(s). From there try to find out who handles the CMTS equipment (Cisco uBR?) equipment in the local office Head End, and likely who handles the network including routers and switches and such. You might even try emailing the domain Technical Contact and explain who you are and ask them if there is an Engineering or Network Administrative contact for the local head end of your city. Good Luck, --- Alan Spicer (a_spicer(a)bellsouth.net) Systems and Network Adminstration http://aspicer.homelinux.net

4 6

New attack against port 135?
by Peter John Hill 10 Oct '03

10 Oct '03

I am seeing lots of scanning of port 135 on my network. 66 byte long packets. Anyone have a name for this? It is less aggressive than the welchia scans I have seen. Seems to scan at about 3000 or so flows per 5 minutes. Thanks Peter Hill Network Engineer Carnegie Mellon

3 2

PGP key signing at NANOG 29 in Chicago [REVISED]
by Joe Abley 10 Oct '03

10 Oct '03

[the original mail I sent had the wrong date in the third paragraph; this one has the right date. sorry about the confusion.] There will be a brief introduction to PGP key signing presented in the General Session at 11:15 a.m. on Monday, entitled "Building a Web of Trust". New for NANOG 29: you will find stickers available at the checkin desk which which you can stick on your name tag. The red dot means "I sign keys"; the idea is to make it easier to identify people for whom PGP key signing is interesting when you meet them outside the signing party. Key Signing Party We will be holding a PGP Key signing party at the NANOG 29 meeting in Chicago. We have been scheduled to meet on Monday 20 October, after the ISP Security and NSP-SEC BOF, at around 9pm in Salon F. If the BOF runs on, we will delay a little. The procedure we will use at the key signing party is as follows: 1. People who wish to participate should email an ASCII extract of their PGP public key to <jabley(a)isc.org> by noon on Monday 20 October 2003. Please include a subject line of "NANOG PGP KEY", and please avoid MIME-encrypting your e-mail if possible. The method of generating the ASCII extract under Unix is: pgp -kxa my_email_address mykey.asc (pgp 2.6.2) pgpk -xa my_email_address > mykey.asc (pgp 5.x) gpg --export -a my_email_address > mykey.asc (gpg) If you're using Windows or Macintosh, hopefully it will be Intuitively Obvious (tm) using the GUI interface how to generate an ASCII armored key that begins: -----BEGIN PGP PUBLIC KEY BLOCK----- 2. After 6pm on Monday, you will be able to fetch a complete key ring with all of the keys that were submitted from <http://www.isc.org/misc/nanog29.pgp> (an ASCII copy will also be available from <http://www.isc.org/misc/nanog29.txt>). 3. At 9pm, come prepared with the PGP Key fingerprint of your PGP public key; we will have handouts with all of the key fingerprints of the keys that people have mailed in. 4. In turn, readers at the front of the room will recite people's keys; as your key fingerprint is read, stand up, and at the end of reading of your PGP key fingerprint, acknowledge that the fingerprint as read was correct. 5. While everybody is in the room together, it's a good chance to verify the identities of people whose key fingerprints you have checked, if you don't already know them personally. You might want to bring photo id with you (drivers licence, passport, etc) to make it easier for other people to confirm your identity. 6. Later that day, or perhaps when you get home, you can sign the keys corresponding to the fingerprints which you were able to verify on the handout; note that it is advisable that you only sign keys of people when you have personal knowledge that the person who stood up during the reading of his/her fingerprint really is the person which he/she claimed to be. 7. Submit the keys you have signed to the PGP keyservers. A good one to use is the one at MIT: simply send mail containing the ascii armored version of your PGP public key to pgp(a)pgp.mit.edu. Note that you don't have to have a laptop with you; if you don't have any locally trusted computing resources during the key signing party, you can make notes on the handout, and then take the handout home and sign the keys later.

1 0

Re: PGP key signing at NANOG 29 in Chicago
by Joe Abley 10 Oct '03

10 Oct '03

On 10 Oct 2003, at 13:30, Valdis.Kletnieks(a)vt.edu wrote: > On Fri, 10 Oct 2003 13:20:16 EDT, you said: > >> Chicago. We have been scheduled to meet on Monday, June 2, after the >> ISP Security and NSP-SEC BOF, at around 9pm in Salon F. If the BOF >> runs > > date/time/location check??? Arrgh. Monday 20 October, is what I meant. June 2 was the last one :) I will send another one. Apologies for the idiocy.

1 0

PGP key signing at NANOG 29 in Chicago
by Joe Abley 10 Oct '03

10 Oct '03

There will be a brief introduction to PGP key signing presented in the General Session at 11:15 a.m. on Monday, entitled "Building a Web of Trust". New for NANOG 29: you will find stickers available at the checkin desk which which you can stick on your name tag. The red dot means "I sign keys"; the idea is to make it easier to identify people for whom PGP key signing is interesting when you meet them outside the signing party. Key Signing Party We will be holding a PGP Key signing party at the NANOG 29 meeting in Chicago. We have been scheduled to meet on Monday, June 2, after the ISP Security and NSP-SEC BOF, at around 9pm in Salon F. If the BOF runs on, we will delay a little. The procedure we will use at the key signing party is as follows: 1. People who wish to participate should email an ASCII extract of their PGP public key to <jabley(a)isc.org> by noon on Monday 20 October 2003. Please include a subject line of "NANOG PGP KEY", and please avoid MIME-encrypting your e-mail if possible. The method of generating the ASCII extract under Unix is: pgp -kxa my_email_address mykey.asc (pgp 2.6.2) pgpk -xa my_email_address > mykey.asc (pgp 5.x) gpg --export -a my_email_address > mykey.asc (gpg) If you're using Windows or Macintosh, hopefully it will be Intuitively Obvious (tm) using the GUI interface how to generate an ASCII armored key that begins: -----BEGIN PGP PUBLIC KEY BLOCK----- 2. After 6pm on Monday, you will be able to fetch a complete key ring with all of the keys that were submitted from <http://www.isc.org/misc/nanog29.pgp> (an ASCII copy will also be available from <http://www.isc.org/misc/nanog29.txt>). 3. At 9pm, come prepared with the PGP Key fingerprint of your PGP public key; we will have handouts with all of the key fingerprints of the keys that people have mailed in. 4. In turn, readers at the front of the room will recite people's keys; as your key fingerprint is read, stand up, and at the end of reading of your PGP key fingerprint, acknowledge that the fingerprint as read was correct. 5. While everybody is in the room together, it's a good chance to verify the identities of people whose key fingerprints you have checked, if you don't already know them personally. You might want to bring photo id with you (drivers licence, passport, etc) to make it easier for other people to confirm your identity. 6. Later that day, or perhaps when you get home, you can sign the keys corresponding to the fingerprints which you were able to verify on the handout; note that it is advisable that you only sign keys of people when you have personal knowledge that the person who stood up during the reading of his/her fingerprint really is the person which he/she claimed to be. 7. Submit the keys you have signed to the PGP keyservers. A good one to use is the one at MIT: simply send mail containing the ascii armored version of your PGP public key to pgp(a)pgp.mit.edu. Note that you don't have to have a laptop with you; if you don't have any locally trusted computing resources during the key signing party, you can make notes on the handout, and then take the handout home and sign the keys later.

1 0

RE: contact at yahoo mail? (they think we're an open relay :< )
by Mark Jeftovic 10 Oct '03

10 Oct '03

Its a very confusing page to read, we are listed as 127.0.0.2 and that is NERD-CA. The other entries like: ARIXDICTSTALE Sender has a history of dictionary spamming: stale.dict.rbl.arix.com -> 127.0.0.1 I think indicate what that RBL is for and what the value indicates, we are NOT in there: host smtp.easydns.comstale.dict.rbl.arix.com and the txt record looks like a wildcard for all of the lists. In fact, several of the people who emailed me off list saying "you're in no-more-funn" were ALSO listed in "no-more-funn" in the same manner. So that, combined with the number of "same here" posts wrt yahoo lead me to believe that that's not the reason. -mark On Thu, 9 Oct 2003, Thor Larholm wrote: > If you would read the page through, you would see that you are listed > MULTIPLE places. > > No-more-funn.moensted.dk > ARIXDICTSTALE > NERD-CA > NERD-ZZ > > Only the last two are country specific > > /thor > > -----Original Message----- > From: Mark Jeftovic [mailto:markjr@easydns.com] > Sent: Thursday, October 09, 2003 2:30 PM > To: Thor Larholm > Cc: nanog(a)merit.org > Subject: RE: contact at yahoo mail? (they think we're an open relay :< ) > > > > We are listed in no-more-funn.moensted.dk as 127.0.0.2 which > is described as: > > + NERD-CA ip-space assigned to Canada: ca.countries.nerd.dk -> 127.0.0.2 > 216.220.40/24 is in ca, rejected based on geographical location > about: Please see our webpage for more information > about: This zone lists ONLY based on geographic information > about: The zone does NOT contain known spammers, nor open relays > > We do cop to being Canadian, but that's about it. I hope yahoo isn't > keying on this RBL. > > -mark > > ...and we've already filled out the retest form at Yahoo. > > On Thu, 9 Oct 2003, Thor Larholm wrote: > > > If you read through all of that page, you will notice that Yahoo > > itself has a re-test script you can use to trigger a verification. > > > > http://add.yahoo.com/fast/help/us/mail/cgi_retest > > > > Yahoo is not your only problem, if you look at > > http://moensted.dk/spam/?addr=216.220.40.247 you will notice that > > several DNSBL lists that IP address. No-more-fun believes it to be a > > "Direct spam source" and ArixDictStale says it has performed active > > dictionary attacks within the last 3 months. > > > > If you want to positively check whether you are an open relay, I would > > > recommend testing through ORDB at http://ordb.org/submit/ > > > > > > Regards > > Thor Larholm > > PivX Solutions, LLC - Senior Security Researcher > > > > -----Original Message----- > > From: Mark Jeftovic [mailto:markjr@easydns.com] > > Sent: Thursday, October 09, 2003 1:23 PM > > To: nanog(a)merit.org > > Subject: contact at yahoo mail? (they think we're an open relay :< ) > > > > > > > > > > Today our email forwarders started getting this from yahoo.com mail > > handlers: > > > > 553 Mail from 216.220.40.247 not allowed - VS99-IP1 deferred - see > > help.yahoo.com/help/us/mail/defer/defer-02.html (#5.7.1) Connection > > closed by foreign host. > > > > Which when you go look at that page basically tells you you're > > probably an open relay (which we're not), etc. > > > > Can any mail admins at Yahoo contact me offlist, or post what the > > restrictions are or at what levels this will kick in? > > > > -mark > > > > > > -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 6