<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Hi All,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Seems my last email generated some interesting back and forth between people. As I’m sending this from my official work address, I don’t want to comment on it or respond to them. I may follow up with my private thoughts from my personal address later.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I just want to thank everyone who replied to me off-list to help me locate contacts for these carriers. I have now found a contact in TPG and iiNet. More contacts from Telstra also surfaced. Judging from another thread on AusNOG it seems that someone from Optus might not be on this mailing list, so I’ll try different avenues. Worst comes to worst, I might even end up calling their general helpline and hope that I can convince the ‘helpdesk’ to put me in touch with someone in network security! Fingers crossed it won’t come to that >_<<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Anyway, thanks guys. If there are any more interesting developments on this project, I’ll post to the list again.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Cheers,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Parth<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='color:#002060;mso-fareast-language:EN-AU'>Parth Shukla</span></b><span style='color:#00B050;mso-fareast-language:EN-AU'> </span><span style='color:#002060;mso-fareast-language:EN-AU'>|<b> </b>Information Security Analyst</span><span style='color:gray;mso-fareast-language:EN-AU'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>AusCERT | Australia’s premier computer emergency response team <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>The University of Queensland | Brisbane QLD 4072 | Australia<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>t: (07) 334 64537 |e: </span><span style='font-size:9.0pt;color:#1F497D;mso-fareast-language:EN-AU'><a href="mailto:pparth@auscert.org.au">pparth@auscert.org.au</a></span><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> w: <a href="http://www.auscert.org.au/">www.auscert.org.au</a> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:green;mso-fareast-language:EN-AU'>Save a tree. Don't print this e-mail unless it's really necessary </span><span style='color:#1F497D;mso-fareast-language:EN-AU'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'> Parth Shukla [mailto:pparth@auscert.org.au] <br><b>Sent:</b> Wednesday, 29 May 2013 11:05 AM<br><b>To:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> RE: Analysis of the Carna Botnet (Internet Census 2012)<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Hey all,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I am still looking for contacts for: TPG, Optus and iiNet! <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Someone did kindly forward my email to iiNet security team so I’ll wait a day or two more to hear from them still…<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Anyone? Anything?!<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Cheers,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Parth<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='color:#002060;mso-fareast-language:EN-AU'>Parth Shukla</span></b><span style='color:#00B050;mso-fareast-language:EN-AU'> </span><span style='color:#002060;mso-fareast-language:EN-AU'>|<b> </b>Information Security Analyst</span><span style='color:gray;mso-fareast-language:EN-AU'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>AusCERT | Australia’s premier computer emergency response team <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>The University of Queensland | Brisbane QLD 4072 | Australia<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>t: (07) 334 64537 |e: </span><span style='font-size:9.0pt;color:#1F497D;mso-fareast-language:EN-AU'><a href="mailto:pparth@auscert.org.au">pparth@auscert.org.au</a></span><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> w: <a href="http://www.auscert.org.au/">www.auscert.org.au</a> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:green;mso-fareast-language:EN-AU'>Save a tree. Don't print this e-mail unless it's really necessary </span><span style='color:#1F497D;mso-fareast-language:EN-AU'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'> Parth Shukla [mailto:pparth@auscert.org.au] <br><b>Sent:</b> Tuesday, 28 May 2013 12:39 PM<br><b>To:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> Re: Analysis of the Carna Botnet (Internet Census 2012)<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Hi All,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I’m hoping most of you have had a chance to at least have a quick look at my presentation by now. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I’m now after technical contacts for three of the four most prominent Telco’s that are present in the Australian data (slide 44 of my presentation). I am hoping to work with someone fairly technical in helping deal with the problem of vulnerable devices through default logins on telnet on their infrastructure.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I’m after (generic and/or non-generic) technical and security focused contact details for:<b> TPG, Optus and iiNet</b>. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The IP ranges for these three and Telstra represent 75% of compromised devices in Australia. I already have generic email for Telstra which I’ll use but if someone here form Telstra wants to contact me directly please feel free.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Could someone from these three please contact me off-list? If someone has good contacts in any of them, could you either a) forward my email to them asking them to contact me or b) email me their contact details off-list?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I will be providing them with the part of the data that is relevant to their network.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Cheers,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Parth<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='color:#002060;mso-fareast-language:EN-AU'>Parth Shukla</span></b><span style='color:#00B050;mso-fareast-language:EN-AU'> </span><span style='color:#002060;mso-fareast-language:EN-AU'>|<b> </b>Information Security Analyst</span><span style='color:gray;mso-fareast-language:EN-AU'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>AusCERT | Australia’s premier computer emergency response team <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>The University of Queensland | Brisbane QLD 4072 | Australia<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>t: (07) 334 64537 |e: </span><span style='font-size:9.0pt;color:#1F497D;mso-fareast-language:EN-AU'><a href="mailto:pparth@auscert.org.au">pparth@auscert.org.au</a></span><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> w: <a href="http://www.auscert.org.au/">www.auscert.org.au</a> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:green;mso-fareast-language:EN-AU'>Save a tree. Don't print this e-mail unless it's really necessary </span><span style='color:#1F497D;mso-fareast-language:EN-AU'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'> Parth Shukla [mailto:pparth@auscert.org.au] <br><b>Sent:</b> Friday, 24 May 2013 7:45 PM<br><b>To:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> Analysis of the Carna Botnet (Internet Census 2012)<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Dear All,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have made my presentation on the Carna Botnet freely available for view and/or download: <a href="http://bit.ly/auscertcarna">http://bit.ly/auscertcarna</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This presentation is on the Compromised Devices of the Carna Botnet (also known as Internet Census 2012). This analysis is done from data obtained directly from the researcher. The data used is NOT publicly available for download.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This was recently presented at the AusCERT Conference 2013. Info: <a href="http://conference.auscert.org.au/conf2013/speaker_Parth_Shukla.html">http://conference.auscert.org.au/conf2013/speaker_Parth_Shukla.html</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This presentation is freely available for viewing and downloading as I wish to spread awareness of the issues raised as a result of the Carna Botnet.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am sending this email as I suspect many of you will find the contents of this presentation interesting. Apologies to those who are subscribed to multiple mailing lists and are receiving this email multiple times as a result. Please forward this onto any mailing list or any individual who you think may appreciate the contents of the presentation.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Regards,<o:p></o:p></p><p class=MsoNormal>Parth<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span style='color:#002060;mso-fareast-language:EN-AU'>Parth Shukla</span></b><span style='color:#00B050;mso-fareast-language:EN-AU'> </span><span style='color:#002060;mso-fareast-language:EN-AU'>|<b> </b>Information Security Analyst</span><span style='color:gray;mso-fareast-language:EN-AU'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>AusCERT | Australia’s premier computer emergency response team <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>The University of Queensland | Brisbane QLD 4072 | Australia<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'>t: (07) 334 64537 |e: </span><span style='font-size:9.0pt;color:#1F497D;mso-fareast-language:EN-AU'><a href="mailto:pparth@auscert.org.au">pparth@auscert.org.au</a></span><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> w: <a href="http://www.auscert.org.au/">www.auscert.org.au</a> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:gray;mso-fareast-language:EN-AU'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;color:green;mso-fareast-language:EN-AU'>Save a tree. Don't print this e-mail unless it's really necessary </span><span style='mso-fareast-language:EN-AU'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>