June 2012 - Test - lists.nanog.org

Re: DNS poisoning at Google?
by Grant Ridder 27 Jun '12

27 Jun '12

It also redirects with facebook, youtube, and ebay but NOT amazon. -Grant On Wed, Jun 27, 2012 at 12:57 AM, Matthew Black <Matthew.Black(a)csulb.edu>wrote: > Our web lead was able to run curl. Thanks.**** > > ** ** > > matthew black**** > > information technology services**** > > california state university, long beach**** > > ** ** > > *From:* Grant Ridder [mailto:shortdudey123@gmail.com] > *Sent:* Tuesday, June 26, 2012 10:53 PM > *To:* Matthew Black > *Cc:* Landon Stewart; nanog(a)nanog.org; Jeremy Hanmer > > *Subject:* Re: DNS poisoning at Google?**** > > ** ** > > Matt, what happens you get on a subnet that can access the webservers > directly and bypass the load balancer. Try curl then and see if its > something w/ the webserver or load balancer.**** > > ** ** > > -Grant**** > > On Wed, Jun 27, 2012 at 12:40 AM, Matthew Black <Matthew.Black(a)csulb.edu> > wrote:**** > > Thanks again to everyone who helped. I didn't know what to enter with > curl, because Outlook clobbered the line breaks in Jeremy's original > message. > > Also, curl failed on our primary webserver because of firewall and load > balancer magic settings. The Telnet method worked better! > > Our team is now scouring for that hidden redirect to couchtarts.**** > > > matthew black > information technology services > california state university, long beach > > > **** > > From: Landon Stewart [mailto:lstewart@superb.net]**** > > Sent: Tuesday, June 26, 2012 10:37 PM > To: Matthew Black > Cc: Jeremy Hanmer; nanog(a)nanog.org**** > > Subject: Re: DNS poisoning at Google?**** > > There is definitely a 301 redirect. > > $ curl -I --referer http://www.google.com/ http://www.csulb.edu/ > HTTP/1.1 <http://www.csulb.edu/%0d%0aHTTP/1.1> 301 Moved Permanently > Date: Wed, 27 Jun 2012 05:36:31 GMT > Server: Apache/2.0.63 > Location: http://www.couchtarts.com/media.php > Connection: close > Content-Type: text/html; charset=iso-8859-1**** > > On 26 June 2012 22:05, Matthew Black <Matthew.Black(a)csulb.edu<mailto: > Matthew.Black(a)csulb.edu>> wrote: > Google Webtools reports a problem with our HOMEPAGE "/". That page is not > redirecting anywhere. > They also report problems with some 48 other primary sites, none of which > redirect to the offending couchtarts. > > matthew black > information technology services > california state university, long beach > > > > > -----Original Message-----**** > > From: Jeremy Hanmer [mailto:jeremy.hanmer@dreamhost.com<mailto: > jeremy.hanmer(a)dreamhost.com>] > Sent: Tuesday, June 26, 2012 9:58 PM > To: Matthew Black**** > > Cc: nanog(a)nanog.org<mailto:nanog@nanog.org> > Subject: Re: DNS poisoning at Google? > It's not DNS. If you're sure there's no htaccess files in place, check > your content (even that stored in a database) for anything that might be > altering data based on referrer. This simple test shows what I mean:**** > > Airy:~ user$ curl -e 'http://google.com' csulb.edu<http://csulb.edu> > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head>**** > > <title>301 Moved Permanently</title> > </head><body> > <h1>Moved Permanently</h1> > <p>The document has moved <a href="http://www.couchtarts.com/media.php > ">here</a>.</p> > </body></html> > > Running curl without the -e argument gives the proper site contents.**** > > On Jun 26, 2012, at 9:24 PM, Matthew Black <Matthew.Black(a)csulb.edu > <mailto:Matthew.Black@csulb.edu>> wrote: > > > Running Apache on three Solaris webservers behind a load balancer. No MS > Windows! > > > > Not sure how malicious software could get between our load balancer and > Unix servers. Thanks for the tip! > > > > matthew black > > information technology services > > california state university, long beach > > > > > >**** > > > From: Landon Stewart [mailto:lstewart@superb.net<mailto: > lstewart(a)superb.net>]**** > > > Sent: Tuesday, June 26, 2012 9:07 PM > > To: Matthew Black**** > > > Cc: nanog(a)nanog.org<mailto:nanog@nanog.org>**** > > > Subject: Re: DNS poisoning at Google? > > > > Is it possible that some malicious software is listening and injecting a > redirect on the wire? We've seen this before with a Windows machine being > infected.**** > > > On 26 June 2012 20:53, Matthew Black <Matthew.Black(a)csulb.edu<mailto: > Matthew.Black(a)csulb.edu><mailto:Matthew.Black@csulb.edu<mailto: > Matthew.Black(a)csulb.edu>>> wrote: > > Google Safe Browsing and Firefox have marked our website as containing > malware. They claim our home page returns no results, but redirects users > to another compromised website couchtarts.com<http://couchtarts.com>< > http://couchtarts.com>.**** > > > > > We have thoroughly examined our root .htaccess and httpd.conf files and > are not redirecting to the problem target site. No recent changes either. > > > > We ran some NSLOOKUPs against various public DNS servers and > intermittently get results that are NOT our servers. > > > > We believe the DNS servers used by Google's crawler have been poisoned. > > > > Can anyone shed some light on this? > > > > matthew black > > information technology services > > california state university, long beach**** > > > www.csulb.edu<http://www.csulb.edu><http://www.csulb.edu>< > http://www.csulb.edu> > > > > > > > > -- > > Landon Stewart <LStewart(a)Superb.Net<mailto:LStewart@Superb.Net<mailto: > LStewart(a)Superb.Net>>> > > Sr. Administrator > > Systems Engineering > > Superb Internet Corp - 888-354-6128 x 4199<tel:888-354-6128%20x%204199> > Web hosting and more "Ahead**** > > > of the Rest": > > http://www.superbhosting.net<http://www.superbhosting.net/> > > > > > > > > > -- > Landon Stewart <LStewart(a)Superb.Net<mailto:LStewart@Superb.Net>> > Sr. Administrator > Systems Engineering > Superb Internet Corp - 888-354-6128 x 4199 > Web hosting and more "Ahead of the Rest": http://www.superbhosting.net< > http://www.superbhosting.net/>**** > > ** ** >

8 9

New I-D on SLAAC DNS configuration problems (Fwd: New Version Notification for draft-gont-6man-slaac-dns-config-issues-00.txt)
by Fernando Gont 27 Jun '12

27 Jun '12

Folks, We have published a new Internet-Draft entitled "Current issues with DNS Configuration Options for SLAAC". This draft if meant to address the SLAAC DNS configuration issues raised by Pavel on the 6man mailing-list, and also discusses other potential issues. The I-D is available at: <http://www.ietf.org/internet-drafts/draft-gont-6man-slaac-dns-config-issues…> The I-D is aimed at 6man, so please considering weighing in the corresponding mailing-list (that of the 6man wg). Any comments will be highly appreciated (including off-list and posts to the nanog list). Thanks! Best regards, Fernando -------- Original Message -------- Subject: New Version Notification for draft-gont-6man-slaac-dns-config-issues-00.txt Date: Thu, 14 Jun 2012 18:36:26 -0700 From: internet-drafts(a)ietf.org To: fgont(a)si6networks.com CC: pavlix(a)pavlix.net A new version of I-D, draft-gont-6man-slaac-dns-config-issues-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Filename: draft-gont-6man-slaac-dns-config-issues Revision: 00 Title: Current issues with DNS Configuration Options for SLAAC Creation date: 2012-06-15 WG ID: Individual Submission Number of pages: 14 URL: http://www.ietf.org/internet-drafts/draft-gont-6man-slaac-dns-config-issues… Status: http://datatracker.ietf.org/doc/draft-gont-6man-slaac-dns-config-issues Htmlized: http://tools.ietf.org/html/draft-gont-6man-slaac-dns-config-issues-00 Abstract: RFC 6106 specifies two Neighbor Discovery options that can be included in Router Advertisement messages to convey information about DNS recursive servers and DNS Search Lists. Small lifetime values for the aforementioned options have been found to cause interoperability problems in those network scenarios in which these options are used to convey DNS-related information. This document analyzes the aforementioned problem, and formally updates RFC 6106 such that these issues are mitigated. The IETF Secretariat -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

DDI (DNS+DHCP+IPAM) Solutions
by Eric Cables 27 Jun '12

27 Jun '12

I'm looking to consolidate DNS/DHCP/IPAM into a single tool. Today I use IPPlan for IPAM, and have been reasonably happy with it over the last 5+ years, but I'd like to leverage the benefits of integrating DNS and DHCP for real-time information, along with a more supportable solution for my staff. It seems that InfoBlox and BlueCat are the top players, but maybe I'm being fooled by the hype. Can anyone respond with their experience with DDI in an Enterprise environment? Have the tools been useful/reliable? What is the pricing model?Replies can be on, or off, list. -- Eric Cables

5 4

RE: DNS poisoning at Google?
by Matthew Black 27 Jun '12

27 Jun '12

Google Webtools reports a problem with our HOMEPAGE "/". That page is not redirecting anywhere. They also report problems with some 48 other primary sites, none of which redirect to the offending couchtarts. matthew black information technology services california state university, long beach -----Original Message----- From: Jeremy Hanmer [mailto:jeremy.hanmer@dreamhost.com] Sent: Tuesday, June 26, 2012 9:58 PM To: Matthew Black Cc: nanog(a)nanog.org Subject: Re: DNS poisoning at Google? It's not DNS. If you're sure there's no htaccess files in place, check your content (even that stored in a database) for anything that might be altering data based on referrer. This simple test shows what I mean: Airy:~ user$ curl -e 'http://google.com' csulb.edu <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.couchtarts.com/media.php">here</a>.</p> </body></html> Running curl without the -e argument gives the proper site contents. On Jun 26, 2012, at 9:24 PM, Matthew Black <Matthew.Black(a)csulb.edu> wrote: > Running Apache on three Solaris webservers behind a load balancer. No MS Windows! > > Not sure how malicious software could get between our load balancer and Unix servers. Thanks for the tip! > > matthew black > information technology services > california state university, long beach > > > > From: Landon Stewart [mailto:lstewart@superb.net] > Sent: Tuesday, June 26, 2012 9:07 PM > To: Matthew Black > Cc: nanog(a)nanog.org > Subject: Re: DNS poisoning at Google? > > Is it possible that some malicious software is listening and injecting a redirect on the wire? We've seen this before with a Windows machine being infected. > On 26 June 2012 20:53, Matthew Black <Matthew.Black(a)csulb.edu<mailto:Matthew.Black@csulb.edu>> wrote: > Google Safe Browsing and Firefox have marked our website as containing malware. They claim our home page returns no results, but redirects users to another compromised website couchtarts.com<http://couchtarts.com>. > > We have thoroughly examined our root .htaccess and httpd.conf files and are not redirecting to the problem target site. No recent changes either. > > We ran some NSLOOKUPs against various public DNS servers and intermittently get results that are NOT our servers. > > We believe the DNS servers used by Google's crawler have been poisoned. > > Can anyone shed some light on this? > > matthew black > information technology services > california state university, long beach > www.csulb.edu<http://www.csulb.edu><http://www.csulb.edu> > > > > -- > Landon Stewart <LStewart(a)Superb.Net<mailto:LStewart@Superb.Net>> > Sr. Administrator > Systems Engineering > Superb Internet Corp - 888-354-6128 x 4199 Web hosting and more "Ahead > of the Rest": > http://www.superbhosting.net<http://www.superbhosting.net/> >

7 9

RE: DNS poisoning at Google?
by David Hubbard 27 Jun '12

27 Jun '12

Typically if google were pulling your site sometimes from the wrong IP, their safe browsing page should indicate it being on another AS number in addition to the correct one 2152: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http ://www.csulb.edu For example, the couchtarts site they claim yours is redirecting to: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http ://www.couchtarts.com That site's DNS is screwed up and some requests are sent to a different IP at a different host, so Google picked up both AS numbers. Could one of your domain's subdomains be what is actually infected? You seem to have a bunch of them, maybe google is penalizing the whole domain over a subdomain? Not sure if they do that or not. If your sites are running off of an application like wordpress, etc., you may not get the same page that google gets and the application may have been hacked. Here's a wget command you can use to make requests to your site pretending to be google: wget -c \ --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" \ --output-document=googlebot.html 'http://www.csulb.edu' nanog will probably line wrap that user agent line making it not correct so you'll have to put it back together correctly. It will save the output to a file named googlebot.html you can look at to see if anything weird ends up being served. David > -----Original Message----- > From: Matthew Black [mailto:Matthew.Black@csulb.edu] > Sent: Tuesday, June 26, 2012 11:53 PM > To: nanog(a)nanog.org > Subject: DNS poisoning at Google? > > Google Safe Browsing and Firefox have marked our website as > containing malware. They claim our home page returns no > results, but redirects users to another compromised website > couchtarts.com. > > We have thoroughly examined our root .htaccess and httpd.conf > files and are not redirecting to the problem target site. No > recent changes either. > > We ran some NSLOOKUPs against various public DNS servers and > intermittently get results that are NOT our servers. > > We believe the DNS servers used by Google's crawler have been > poisoned. > > Can anyone shed some light on this? > > matthew black > information technology services > california state university, long beach > www.csulb.edu<http://www.csulb.edu> > > >

8 11

RE: DNS poisoning at Google?
by David Hubbard 27 Jun '12

27 Jun '12

Well as Jeremy pointed out, your site is issuing redirects, he gave you the command to show it: curl -e 'http://google.com' csulb.edu So if you're sure your server(s) haven't been hacked, your application appears to have been hacked. It only issues the redirect if the visitor comes in from a google search. > -----Original Message----- > From: Matthew Black [mailto:Matthew.Black@csulb.edu] > Sent: Wednesday, June 27, 2012 1:03 AM > To: Michael J Wise > Cc: nanog(a)nanog.org > Subject: RE: DNS poisoning at Google? > > Q:have you consulted the logs? > > Seriously? Our servers have multiple log files due to > multiple virtual hosts. Our primary domain log file on just > one server has over 600,000 records x 3 servers. > > Probably over 100,000 304 redirects in our logs. > > couchtarts.com does not appear in our log files. > > > matthew black > information technology services > california state university, long beach > > -----Original Message----- > From: Michael J Wise [mailto:mjwise@kapu.net] > Sent: Tuesday, June 26, 2012 9:56 PM > To: Matthew Black > Cc: nanog(a)nanog.org > Subject: Re: DNS poisoning at Google? > > > On Jun 26, 2012, at 9:35 PM, Matthew Black wrote: > > > Yes, we've used the Google Webmaster Tools a lot today. > Submitted multiple requests and they keep insisting that our > site issues a redirect. Unable to duplicate the problem here. > > ... have you consulted the logs? > If the redirect is there, it ... 1) might not be from the > home page, and 2) could be in ... user content? > > awk '{if ($9 ~ /304/) { print $0 }}' access_log. > ... or some such. > Granted, might be a storm of " " -> index.html redirects, but > they should be grep -v 'able in short order. > You might also look for the rDNS of the Google spider to see > exactly where it is looking, and what it sees. > > Aloha, > Michael. > -- > "Please have your Internet License > and Usenet Registration handy..." > > > > > >

2 1

Re: [MailServer Notification]Web Reputation Notification
by Ishmael Rufus 27 Jun '12

27 Jun '12

IIRC Google safe browsing should be using its own DNS. Nevertheless, my experience with Google's DNS is that it takes at least 2 hours before DNS records would update. If anyone knows more feel free to shed any light on Google's DNS and Google SafeBrowsing. On Tue, Jun 26, 2012 at 11:51 PM, Matthew Black <Matthew.Black(a)csulb.edu>wrote: > Yes, isn’t it! What DNS server does Google Safe Browsing use?**** > > ** ** > > matthew black**** > > information technology services**** > > california state university, long beach**** > > ** ** > > ** ** > > ** ** > > *From:* Ishmael Rufus [mailto:sakamura@gmail.com] > *Sent:* Tuesday, June 26, 2012 9:45 PM > *To:* Matthew Black > *Cc:* nanog(a)nanog.org > *Subject:* Re: [MailServer Notification]Web Reputation Notification**** > > ** ** > > Access the site via domain name: SaferBrowsing message**** > > Access the site via IP: works fine.**** > > ** ** > > Interesting...**** > > On Tue, Jun 26, 2012 at 11:36 PM, Administrator < > administrator(a)do.not.reply> wrote:**** > > www.couchtarts.com has been detected as > suspicious URLs,and Tag and deliver has been > taken on 6/26/2012 10:36:04 PM. > Message details: > Server: MAIL > Sender: Matthew.Black(a)csulb.edu; > Recipient: sakamura@gmail.com;nanog@nanog.org; > Subject: Suspicious URL: RE: DNS poisoning at Google?**** > > ** ** >

1 0

Re: [MailServer Notification]Web Reputation Notification
by Ishmael Rufus 27 Jun '12

27 Jun '12

Access the site via domain name: SaferBrowsing message Access the site via IP: works fine. Interesting... On Tue, Jun 26, 2012 at 11:36 PM, Administrator <administrator(a)do.not.reply>wrote: > www.couchtarts.com has been detected as > suspicious URLs,and Tag and deliver has been > taken on 6/26/2012 10:36:04 PM. > Message details: > Server: MAIL > Sender: Matthew.Black(a)csulb.edu; > Recipient: sakamura@gmail.com;nanog@nanog.org; > Subject: Suspicious URL: RE: DNS poisoning at Google? >

1 1

Re: strat-1 gps
by Ryan Malayter 26 Jun '12

26 Jun '12

+1 on the freesd-or-linux. with say a Garmin GPS-18x or whatever timing puck. Have an intern or junior tech tackle it as a learning exercise. The time geeks on comp.protocols.time.ntp seem to favor low-power Soekris hardware (http://soekris.com/) for stratum-1s. You need RS232 serial to get decent PPS; USB introduces tons of jitter. If you have to have something pre-integrated and soon, I'd look at Meinberg: http://www.meinberg.de/english/products/index.htm#network_sync -- RPM

7 6

ipv6 book recommendations?
by David Hubbard 26 Jun '12

26 Jun '12

Does anyone have suggestions on good books to really get a thorough understanding of v6, subnetting, security practices, etc. Or a few books. Just turned up dual stack with our peers and a test network but I'd like to be a lot more comfortable with it before looking at our customer network. Thanks, David

33 96