- NANOG - lists.nanog.org

more on lame-delegation.org, seems to waste IP space and DNS
by John Brown 18 Jun '03

18 Jun '03

so i've been doing a bit more research on this. NSI has *.lame-delegation.org which is used on zones where selected or all NS are not valid for a zone. some zones have a lame-delegation.org NS listed *AND* a NS that is answering for the zone. most zones have all NS's listed as lame-delegation.org Big deal you say, who cares.... The side affect is that a good chuck of glue records are listed in the the gTLD DNS servers with NS's and IP's that are basicly invalid. In looking at a single /19 used by Rackspace.com, there are 559 NS's listed using IP's from that /19. Of those 559 NS's over 20 are IP's tagged as *.lame-delegation.org. What happens if someone sets up a service on those IP's and a "quasi" lame zone gets a flood of traffic?? That poor customer is going to see a flood of DNS traffic. Hosting providers may not be aware that THEIR IP space is being "renamed" and listed for things they don't have control over. My thoughts are that if a registry as a NS that is not proper for a zone, that it should be REMOVE from the zones NS set. If there are no valid NS's for a zone, then the registry should REMOVE the zone from the DNS. Otherwise the registry zones will just grow with random glue The other registries and registrars are doing similar things, but different names....

6 9

domain hijacker convicted
by Dan Hollis 17 Jun '03

17 Jun '03

http://news.com.com/2100-1002_3-1016447.html Shows you how really worthless verisign's "security" is. How about the FBI start going after the netblock hijackers now? While racine's motivation was political, the netblock hijackers motivation is purely unjust enrichment and theft of service. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

3 4

BTinternet problems?
by Stewart, William C (Bill), RTSLS 17 Jun '03

17 Jun '03

Yes, it appears they had problems: Power failure leads to BTo blackout By Tim Richardson Posted: 17/06/2003 at 11:46 GMT http://theregister.com/content/22/31248.html

1 0

Re: Slow and Fast IP addresses on http ?
by Steven M. Bellovin 17 Jun '03

17 Jun '03

In message <20030616210129.GM751(a)reifa-wave.karrenberg.net>, Daniel Karrenberg writes: > >tcp-wrapper. > >Check DNS of the client address affected, forward and reverse. > It might also be port 113 -- some sites try to query your tcp port 113, and wait for a timeout if the port is firewalled. A better solution than blocking it is to send an immediate RST. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

4 3

Re: Slow and Fast IP addresses on http ?
by Steven M. Bellovin 17 Jun '03

17 Jun '03

In message <g3u1aovd6e.fsf(a)sa.vix.com>, Paul Vixie writes: > >smb(a)research.att.com ("Steven M. Bellovin") writes: > >> It might also be port 113 -- some sites try to query your tcp port 113, >> and wait for a timeout if the port is firewalled. A better solution >> than blocking it is to send an immediate RST. > >people who depend on tcp/113 deserve everything stupid that happens to them. >dropping SYN packets or returning a fixed string are both better than sending >an immediate RST. (false confidence being valued less than low confidence.) >i was rather shocked to discover tcp/113 clientness enabled by default in >postfix and sendmail. but even widespread ignorance does not call for >widespread coddling such as returning immediate RST's. I'm not defending the practice, I'm defending myself against the practitioners. My email, etc., was being delayed because the site I was sending to was trying to query my non-existent tcp/113 server, and I was dropping SYNs. Now, I either send an immediate RST or use Erik Fair's identd, depending on my mood. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

2 2

Fall Meeting with ARIN
by Susan Harris 17 Jun '03

17 Jun '03

Hi everyone - just a quick reminder that our fall meeting will be held in the fabulous city of Chicago, once again in conjunction with ARIN. NANOG meets Sun.-Tues., Oct. 19-21, and ARIN Wed.-Fri., Oct. 22-24. The Call for Presentations will go out in the next few weeks - see you soon.

1 0

Spammers use Trojans
by Sean Donelan 17 Jun '03

17 Jun '03

I don't know what proof MessageLabs has, but they report that spammers are breaking into home PCs of unsuspecting users to send junk mail. http://www.vnunet.com/News/1141610 Spammers are increasingly hijacking home PCs to send junk mail, according to MessageLabs. The managed email service provider claims to have proof of spammers using viruses to plant Trojan malware on PCs to provide remote access.

10 12

Spam from weird IP 118.189.136.119
by Pascal Gloor 17 Jun '03

17 Jun '03

Getting SPAM from 118.189.136.119 relayed by rr.com ? this network is not allocated, nor announced. I have been looking everywhere to find if it has been announced (historical bgp update databases, like RIS RIPE / CIDR REPORT / etc..)... I didnt found anything.... this probably mean rr.com is routing that network internaly. "Received: from [118.189.136.119] by smtp-server1.cfl.rr.com with NNFMP;" If there is any rr.com guy around. Could you please check this? Thanks, Pascal

7 8

RE: Mobile code security (was Re: rr style scanning of non-customers)
by Herb Leong 17 Jun '03

17 Jun '03

> As far as I could tell, the vector was AOL IM. So, it's not only M$ > and outlook. Why oh why are vendors shipping with defaults like no > restrictions on "buddy" downloads and execution? Hiya, The same reason why some linux installs were/are totaly open: They wanted it to work outta the box. It's viewed that it's better to have your product widely in use and insecure (so now the user has to come back and pay you or someone else for security--or take care of it themselves) than to have it secure from the get-go and not used much because it is too much of a PITA to get up and running... /herb

1 0

lightship troubles in boston
by Curtis Maurand 17 Jun '03

17 Jun '03

Anyone know what's going on in Boston with Lightship? Curtis

1 0