- wlug - list.wlug.org.nz

RE: [nznog] RPC DCOM Worm On The Loose
by Lindsay Druett 11 Aug '03

11 Aug '03

Yep... We have live one :-) Secure your Windows Servers, upgrade them to Linux :-) > For those who have not read /. Yet > http://isc.sans.org/diary.html?date=2003-08-11 > > For those who cant read the link > Here is a cut and paste > > > This RPC DCOM worm started spreading early afternoon EDT > (evening UTC). At this point, it is spreading rapidly. > > ********** > NOTE: PRELIMINARY. Do not base your incidents response solely > on this writeup. ********** > > Increase in port 135 activity: > http://isc.sans.org/images/port135percent.png > > Latest update: The worm may launch a syn flood against > windowsupdate.com on the 16th. (unconfirmed) > > The worm uses the RPC DCOM vulnerability to propagate. One it > finds a vulnerable system, it will spawn a shell on port 4444 > and use it to download the actual worm via tftp. The exploit > itself is very close to 'dcom.c' and so far appears to use > the "universal Win2k" offset only. > > The name of the binary is msblast.exe. It is packed with UPX > and will self extract. The size of the binary is about > 11kByte unpacked, and 6kBytes packed: > > MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes) > > So far we found the following properties: > > - Scans sequentially for machines with open port 135, > starting at a presumably random IP address > - uses multiple TFTP servers to pull the binary > - adds a registry key to start itself after reboot > > Name of registry key: > SOFTWARE\Microsoft\Windows\CurrentVersion\Run, name: 'windows > auto update' > > Strings of interest: > > msblast.exe > I just want to say LOVE YOU SAN!! > billy gates why do you make this possible ? Stop making money > and fix your software!! windowsupdate.com start %s tftp -i %s > GET %s %d.%d.%d.%d %i.%i.%i.%i BILLY windows auto update > SOFTWARE\Microsoft\Windows\CurrentVersion\Run > > Existing RPC DCOM snort signatures will detect this worm. The > worm is based on dcom.c > > known tftp servers for this worm: > > 204.210.57.87 > 217.211.179.193 > 24.147.64.171 > 24.147.64.205 > 24.147.64.208 > 24.147.65.146 > 24.147.65.45 > 24.147.65.9 > 61.254.65.159 > 67.119.36.219 > 68.112.65.38 > 68.166.102.136 > 68.166.107.21 > 68.166.111.175 > 68.166.120.34 > 68.166.121.135 > 68.166.123.4 > 68.166.124.186 > 68.166.124.93 > 68.166.139.155 > 68.166.139.210 > 68.166.141.66 > 68.166.142.194 > 68.166.142.215 > 68.166.36.178 > 68.166.56.123 > 68.166.60.51 > 68.166.98.3 > > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nzn> og > >

1 0

Hamilton PC Users Group meeting is tomorrow night
by Meeting Reminder Bot 11 Aug '03

11 Aug '03

The Hamilton PC Users Group meeting is tomorrow night This is an announcement about the Hamilton PC Users Group, not the next WLUG meeting. Feel free to ignore it. If you're interested in the PC Users Group they meet about 7:30pm on the second Wednesday of each week at St Peters Cathedral Hall, which is up the hill at the South End of Victoria Street. They also have a website at http://crash.ihug.co.nz/~jonali/, but it was last modified 09/07/1999 and appears to be out of date.

2 1

RE: [wlug] The Wiki
by Lindsay Druett 11 Aug '03

11 Aug '03

> Some kind soul had the mark-up fixed within minutes. > > Next morning, I went back to the page to view the masterpiece > of the night before. It was gone, refactored out of > existence by some guy in Europe :-) > Now let me guess who that is... It must be Aristotle Pagaltzis

2 1

The Wiki
by Perry Lorier 10 Aug '03

10 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Since we're unlikely to get much traffic to the wiki for the next while from google, perhaps we should do something else to get the traffic up. I propose we have another week of trying to put information into the Wiki. For those of you that haven't tried to contribute, goto http://www.wlug.org.nz/ and find a page, and click the "Edit" button at the bottom. It'll ask you for your name, you can put anything there, just take your first and last names, capitalise them and mush them together, thus "Perry Lorier" -> "PerryLorier". Then edit the page. If you don't know what to add, check out * http://www.wlug.org.nz/HelpingOut * http://www.wlug.org.nz/WantedWikis (generated regularly) Also, perhaps look at what searches people are doing * http://www.wlug.org.nz/webalizer/ * http://www.wlug.org.nz/archive/querys-recent.txt or, if you want a nice long download * http://www.wlug.org.nz/archive/querys.txt Perhaps also try reviews of software you've used, or questions you want answers to. If everyone adds one page a day for 5 days, we will have a huge impact on the amount of extra information in the wiki when google decides to readd us to the index :) - -- I smell a RANCID CORN DOG! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Only when you are sure they have you, can you stop being paranoid iD8DBQE/NPYtcAgRpy8z8UQRAhYiAJ9+YD656zCD0Bh+u2AOKQ9e8FRIOgCeNw3R Jqmktw0eddX/6pBo7B+ZCuA= =b/XM -----END PGP SIGNATURE-----

3 2

Google searches
by Gavin Grieve 09 Aug '03

09 Aug '03

Is it just me or have we fallen off Googles radar? I've tried a few searches including (without the quotes - they just show what i searched for) "wlug", "waikato linux users group", "linux afsnotes", "linux wlug ipv6" and i didn't get a single hit for the wiki. I did get a few hits for "waikato linux users group" that referred to the mailing list, or links from other sites. Has enabling ipv6 on www.wlug.org.nz broken googles ability to access the wiki and provide links to it? Just a thought - not sure what else could be the problem. Ideas? Gavin Grieve

8 11

Re: [wlug] Learning the CLI ... using the wiki as well
by Jared Wigmore 09 Aug '03

09 Aug '03

> I think that the offer that we have for live CLI> tutorials using Rute> is great. But we need also to provide ongoing help.> Is it possible> to make further use of our excellent infrastructure:> the wiki? Can> we have portions of the rute with comments from us> and perhaps with> one or more people proof-reading this part of the> wiki?I think we could. I might be a proof-reader; I've been almost obsessive-compulsive about error correction the last few years. --------------------------------- Yahoo! Personals - New people, new possibilities! Try Yahoo! Personals, FREE for a limited period!

1 0

kppp sucky-motto
by S Swami 06 Aug '03

06 Aug '03

'top(1)' tells me that my ppp connection from the console (while in X) takes significantly less memory than kppp: ------------------------------------------------------------------- # X usage for comparison PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 390 root 18 0 16880 9268 3444 R 3.6 7.3 8:12.19 X # dial-up connection via console PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 24477 root 8 0 876 872 732 S 0.0 0.7 0:00.01 pppd # and then later dial-up connection via kppp PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 25070 sns 9 0 13012 12m 11m S 0.0 10.3 0:01.34 kppp 25071 root 9 0 8080 8080 7624 S 0.0 6.4 0:00.01 kppp ------------------------------------------------------------------- Any advice will be appreciated. (I know what Craig's thinking :) Cheers, Sid.

3 3

geek.nz
by Oliver Jones 06 Aug '03

06 Aug '03

-- Quote --- The new Second Level Domain, .geek.nz, will be available through Domainz from 11am on Tuesday 26 August 2003. .geek.nz will be an open (not moderated) second level, and will be available on a 'first come, first served' basis. Registrations can be made as usual either through our website or using the email template. Please feel free to get in touch with me if you have any questions relating to .geek.nz, or about your Provider account in general. -- Quote --

2 1

Re: [wlug] Some things I use.
by Martin Baehr 06 Aug '03

06 Aug '03

Distribution: debian Instant Messaging: none -> sTeam Web Browser: firebird Email: mutt IRC: ircii (to lazy to look for something better :-), roxenchat (not irc) Music (Ogg/MP3): xmms, mplayer... Movie players: mplayer (works always) (never seen xine working) Office Suite: none Remote Access/Control: ssh PDF: gv Graphics: gimp Image Viewer: xzgv (am not entirely happy with it, but others are worse) Text/Code Editor: vi Personal Finance: vi (i have a text file where i write down all my expenses) Servers: Caudium, sTeam, wwwoffle (occasionally) Window Manager: Window Maker Office: screen (in servers in austria) (the office is the place where you have all the tools you need to do your office work. all i need is a terminal running ssh (putty if necessary) and a network-connection, add a browser and my office is complete) greetings, martin. -- Pike Conference 2003 - Sep 25-27 - http://pike.ida.liu.se/conferences/2003/ -- interested in doing pike programming, sTeam/caudium/pike/roxen training, sTeam/caudium/roxen and/or unix system administration anywhere in the world. -- pike programmer working in europe open-steam.org unix system- bahai.or.at iaeste.(tuwien.ac|or).at administrator (stuts|black.linux-m68k).org is.(schon.org|root.at) Martin Bähr http://www.iaeste.or.at/~mbaehr/

6 9

Domain Names NZ Scam
by Daniel Appleton 05 Aug '03

05 Aug '03

*- Quote --- Domain Names NZ Published at 11:09, 05/08/2003 The Domain Name Commissioner is aware of a mass mail out by an entity trading as "Domain Names NZ". "Domain Names NZ" appears to be sending pro forma letters to registrants of .co.nz domain names. The letters seek fees for the registration of the .net.nz version of the same name. The Domain Name Commissioner is not aware of any authorised .nz domain name registrar using the trade name "Domain Names NZ". The letters to registrants specify a .net.nz domain name to be registered. Bona fide .nz domain name registrars are not permitted to specify a particular domain name in an offer of registry services. The letters are also in a printed form that looks similar to an invoice or a renewal notice. This may cause confusion. Registrants who have recently received what appears to be an invoice or a renewal notice are strongly advised to look carefully at all details before paying any sum requested. Registrants are strongly advised to be cautious before proceeding with any registration offered in a letter from Domain Names NZ. Registrants are also reminded that they are under no obligation to proceed with the registration and that doing nothing will not affect their current domain name. The DNC is monitoring the situation and will investigate any possible breaches of .nz policy. If people have concerns about the actions of Domain Names NZ please email info(a)dnc.org.nz *- End Quote --- I too recieved mail from these fools today. I wrote them a letter in vivid over what they send me and I'm gonna post it back to them. :) -- Daniel http://dapples.net.nz/ -- http://personals.yahoo.com.au - Yahoo! Personals - New people, new possibilities! Try Yahoo! Personals, FREE for a limited period!

2 1