- Test - lists.nanog.org

RE: DNS poisoning at Google?
by Matthew Black 27 Jun '12

27 Jun '12

Google Webtools reports a problem with our HOMEPAGE "/". That page is not redirecting anywhere. They also report problems with some 48 other primary sites, none of which redirect to the offending couchtarts. matthew black information technology services california state university, long beach -----Original Message----- From: Jeremy Hanmer [mailto:jeremy.hanmer@dreamhost.com] Sent: Tuesday, June 26, 2012 9:58 PM To: Matthew Black Cc: nanog(a)nanog.org Subject: Re: DNS poisoning at Google? It's not DNS. If you're sure there's no htaccess files in place, check your content (even that stored in a database) for anything that might be altering data based on referrer. This simple test shows what I mean: Airy:~ user$ curl -e 'http://google.com' csulb.edu <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.couchtarts.com/media.php">here</a>.</p> </body></html> Running curl without the -e argument gives the proper site contents. On Jun 26, 2012, at 9:24 PM, Matthew Black <Matthew.Black(a)csulb.edu> wrote: > Running Apache on three Solaris webservers behind a load balancer. No MS Windows! > > Not sure how malicious software could get between our load balancer and Unix servers. Thanks for the tip! > > matthew black > information technology services > california state university, long beach > > > > From: Landon Stewart [mailto:lstewart@superb.net] > Sent: Tuesday, June 26, 2012 9:07 PM > To: Matthew Black > Cc: nanog(a)nanog.org > Subject: Re: DNS poisoning at Google? > > Is it possible that some malicious software is listening and injecting a redirect on the wire? We've seen this before with a Windows machine being infected. > On 26 June 2012 20:53, Matthew Black <Matthew.Black(a)csulb.edu<mailto:Matthew.Black@csulb.edu>> wrote: > Google Safe Browsing and Firefox have marked our website as containing malware. They claim our home page returns no results, but redirects users to another compromised website couchtarts.com<http://couchtarts.com>. > > We have thoroughly examined our root .htaccess and httpd.conf files and are not redirecting to the problem target site. No recent changes either. > > We ran some NSLOOKUPs against various public DNS servers and intermittently get results that are NOT our servers. > > We believe the DNS servers used by Google's crawler have been poisoned. > > Can anyone shed some light on this? > > matthew black > information technology services > california state university, long beach > www.csulb.edu<http://www.csulb.edu><http://www.csulb.edu> > > > > -- > Landon Stewart <LStewart(a)Superb.Net<mailto:LStewart@Superb.Net>> > Sr. Administrator > Systems Engineering > Superb Internet Corp - 888-354-6128 x 4199 Web hosting and more "Ahead > of the Rest": > http://www.superbhosting.net<http://www.superbhosting.net/> >

7 9

RE: DNS poisoning at Google?
by David Hubbard 27 Jun '12

27 Jun '12

Typically if google were pulling your site sometimes from the wrong IP, their safe browsing page should indicate it being on another AS number in addition to the correct one 2152: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http ://www.csulb.edu For example, the couchtarts site they claim yours is redirecting to: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http ://www.couchtarts.com That site's DNS is screwed up and some requests are sent to a different IP at a different host, so Google picked up both AS numbers. Could one of your domain's subdomains be what is actually infected? You seem to have a bunch of them, maybe google is penalizing the whole domain over a subdomain? Not sure if they do that or not. If your sites are running off of an application like wordpress, etc., you may not get the same page that google gets and the application may have been hacked. Here's a wget command you can use to make requests to your site pretending to be google: wget -c \ --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" \ --output-document=googlebot.html 'http://www.csulb.edu' nanog will probably line wrap that user agent line making it not correct so you'll have to put it back together correctly. It will save the output to a file named googlebot.html you can look at to see if anything weird ends up being served. David > -----Original Message----- > From: Matthew Black [mailto:Matthew.Black@csulb.edu] > Sent: Tuesday, June 26, 2012 11:53 PM > To: nanog(a)nanog.org > Subject: DNS poisoning at Google? > > Google Safe Browsing and Firefox have marked our website as > containing malware. They claim our home page returns no > results, but redirects users to another compromised website > couchtarts.com. > > We have thoroughly examined our root .htaccess and httpd.conf > files and are not redirecting to the problem target site. No > recent changes either. > > We ran some NSLOOKUPs against various public DNS servers and > intermittently get results that are NOT our servers. > > We believe the DNS servers used by Google's crawler have been > poisoned. > > Can anyone shed some light on this? > > matthew black > information technology services > california state university, long beach > www.csulb.edu<http://www.csulb.edu> > > >

8 11

RE: DNS poisoning at Google?
by David Hubbard 27 Jun '12

27 Jun '12

Well as Jeremy pointed out, your site is issuing redirects, he gave you the command to show it: curl -e 'http://google.com' csulb.edu So if you're sure your server(s) haven't been hacked, your application appears to have been hacked. It only issues the redirect if the visitor comes in from a google search. > -----Original Message----- > From: Matthew Black [mailto:Matthew.Black@csulb.edu] > Sent: Wednesday, June 27, 2012 1:03 AM > To: Michael J Wise > Cc: nanog(a)nanog.org > Subject: RE: DNS poisoning at Google? > > Q:have you consulted the logs? > > Seriously? Our servers have multiple log files due to > multiple virtual hosts. Our primary domain log file on just > one server has over 600,000 records x 3 servers. > > Probably over 100,000 304 redirects in our logs. > > couchtarts.com does not appear in our log files. > > > matthew black > information technology services > california state university, long beach > > -----Original Message----- > From: Michael J Wise [mailto:mjwise@kapu.net] > Sent: Tuesday, June 26, 2012 9:56 PM > To: Matthew Black > Cc: nanog(a)nanog.org > Subject: Re: DNS poisoning at Google? > > > On Jun 26, 2012, at 9:35 PM, Matthew Black wrote: > > > Yes, we've used the Google Webmaster Tools a lot today. > Submitted multiple requests and they keep insisting that our > site issues a redirect. Unable to duplicate the problem here. > > ... have you consulted the logs? > If the redirect is there, it ... 1) might not be from the > home page, and 2) could be in ... user content? > > awk '{if ($9 ~ /304/) { print $0 }}' access_log. > ... or some such. > Granted, might be a storm of " " -> index.html redirects, but > they should be grep -v 'able in short order. > You might also look for the rDNS of the Google spider to see > exactly where it is looking, and what it sees. > > Aloha, > Michael. > -- > "Please have your Internet License > and Usenet Registration handy..." > > > > > >

2 1

Re: [MailServer Notification]Web Reputation Notification
by Ishmael Rufus 27 Jun '12

27 Jun '12

IIRC Google safe browsing should be using its own DNS. Nevertheless, my experience with Google's DNS is that it takes at least 2 hours before DNS records would update. If anyone knows more feel free to shed any light on Google's DNS and Google SafeBrowsing. On Tue, Jun 26, 2012 at 11:51 PM, Matthew Black <Matthew.Black(a)csulb.edu>wrote: > Yes, isn’t it! What DNS server does Google Safe Browsing use?**** > > ** ** > > matthew black**** > > information technology services**** > > california state university, long beach**** > > ** ** > > ** ** > > ** ** > > *From:* Ishmael Rufus [mailto:sakamura@gmail.com] > *Sent:* Tuesday, June 26, 2012 9:45 PM > *To:* Matthew Black > *Cc:* nanog(a)nanog.org > *Subject:* Re: [MailServer Notification]Web Reputation Notification**** > > ** ** > > Access the site via domain name: SaferBrowsing message**** > > Access the site via IP: works fine.**** > > ** ** > > Interesting...**** > > On Tue, Jun 26, 2012 at 11:36 PM, Administrator < > administrator(a)do.not.reply> wrote:**** > > www.couchtarts.com has been detected as > suspicious URLs,and Tag and deliver has been > taken on 6/26/2012 10:36:04 PM. > Message details: > Server: MAIL > Sender: Matthew.Black(a)csulb.edu; > Recipient: sakamura@gmail.com;nanog@nanog.org; > Subject: Suspicious URL: RE: DNS poisoning at Google?**** > > ** ** >

1 0

Re: [MailServer Notification]Web Reputation Notification
by Ishmael Rufus 27 Jun '12

27 Jun '12

Access the site via domain name: SaferBrowsing message Access the site via IP: works fine. Interesting... On Tue, Jun 26, 2012 at 11:36 PM, Administrator <administrator(a)do.not.reply>wrote: > www.couchtarts.com has been detected as > suspicious URLs,and Tag and deliver has been > taken on 6/26/2012 10:36:04 PM. > Message details: > Server: MAIL > Sender: Matthew.Black(a)csulb.edu; > Recipient: sakamura@gmail.com;nanog@nanog.org; > Subject: Suspicious URL: RE: DNS poisoning at Google? >

1 1

Re: strat-1 gps
by Ryan Malayter 27 Jun '12

27 Jun '12

+1 on the freesd-or-linux. with say a Garmin GPS-18x or whatever timing puck. Have an intern or junior tech tackle it as a learning exercise. The time geeks on comp.protocols.time.ntp seem to favor low-power Soekris hardware (http://soekris.com/) for stratum-1s. You need RS232 serial to get decent PPS; USB introduces tons of jitter. If you have to have something pre-integrated and soon, I'd look at Meinberg: http://www.meinberg.de/english/products/index.htm#network_sync -- RPM

7 6

ipv6 book recommendations?
by David Hubbard 27 Jun '12

27 Jun '12

Does anyone have suggestions on good books to really get a thorough understanding of v6, subnetting, security practices, etc. Or a few books. Just turned up dual stack with our peers and a test network but I'd like to be a lot more comfortable with it before looking at our customer network. Thanks, David

33 96

Whois data compromised?
by Eric Rosenberry 27 Jun '12

27 Jun '12

Not sure where this data got injected into the system (or who knows, perhaps it's a DNS injection attack or something), but this certainly is not right. :-( Erics-MacBook-Pro-2:~ erosenbe$ whois -h whois.internic.net facebook.com Whois Server Version 2.0 Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. FACEBOOK.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM FACEBOOK.COM.MORE.INFO.AT.WWW.BEYONDWHOIS.COM FACEBOOK.COM.LOVED.BY.WWW.SHQIPHOST.COM FACEBOOK.COM.KNOWS.THAT.THE.BEST.WEB.HOSTING.IS.NASHHOST.NET FACEBOOK.COM.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM FACEBOOK.COM To single out one record, look it up with "xxx", where xxx is one of the of the records displayed above. If the records are the same, look them up with "=xxx" to receive a full display for each record. >>> Last update of whois database: Tue, 26 Jun 2012 21:42:13 UTC <<< NOTICE: The expiration date displayed in this record is the date the registrar's sponsorship of the domain name registration in the registry is currently set to expire. This date does not necessarily reflect the expiration date of the domain name registrant's agreement with the sponsoring registrar. Users may consult the sponsoring registrar's Whois database to view the registrar's reported date of expiration for this registration. TERMS OF USE: You are not authorized to access or query our Whois database through the use of electronic processes that are high-volume and automated except as reasonably necessary to register domain names or modify existing registrations; the Data in VeriSign Global Registry Services' ("VeriSign") Whois database is provided by VeriSign for information purposes only, and to assist persons in obtaining information about or related to a domain name registration record. VeriSign does not guarantee its accuracy. By submitting a Whois query, you agree to abide by the following terms of use: You agree that you may use this Data only for lawful purposes and that under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail, telephone, or facsimile; or (2) enable high volume, automated, electronic processes that apply to VeriSign (or its computer systems). The compilation, repackaging, dissemination or other use of this Data is expressly prohibited without the prior written consent of VeriSign. You agree not to use electronic processes that are automated and high-volume to access or query the Whois database except as reasonably necessary to register domain names or modify existing registrations. VeriSign reserves the right to restrict your access to the Whois database in its sole discretion to ensure operational stability. VeriSign may restrict or terminate your access to the Whois database for failure to abide by these terms of use. VeriSign reserves the right to modify these terms at any time. The Registry database contains ONLY .COM, .NET, .EDU domains and Registrars. Erics-MacBook-Pro-2:~ erosenbe$ -- *Eric Rosenberry* Sr. Infrastructure Architect // Chief Bit Plumber Direct: 503.943.6763 Mobile: 503.348.3625 // XMPP: eric.rosenberry(a)iovation.com *www.iovation.com* <http://www.iovation.com>

7 7

please helpconfederation and ibgp question
by Deric Kwok 26 Jun '12

26 Jun '12

Hi all I would like to ask questions aboutconfederation and ibgp We know confederation from nanog achieve 101,102 and setup lab. bgp and ibgp can work properly but not sure we are doing right. We have quesions 1/ for the annoucing networks, do we have to announce it in border routers? eg: border routers. 66.59.128.0/22 but all ibgp routers are already announcing networks individually in ibgp Routers eg: Router A: 66.59.128.0/24, Router B: 66.59.129.0/24, Router C: 66.59.130.0/24, Router D: 66.59.131.128/25 In our labs, it can work. but we would like to know the setting is correct. or any announcing overlapping when announcing in broder Router and all individual ibgp routers 2/ But if it is not right to announce /22 in broder routers, let Router A,B,C, D announce it in 4 separate networks. ls it ok too? in the lab, the bgp can work too. but i read the bgp doc that it prefers us to announce it in /22 instead of 4 seperate one? 3/ in the border routers, we take out some ip from network 66.59.131.0/24 (eg: 66.59.131.0/28, 66.59.131.16/28) to interconnected to Router A, B, C and D We don't know which one is good for use in bgp configuration redistributed connected or network 66.59.131.0/28 network 66.59.131.16/28 If using network command "network 66.59.131.0/28, network 66.59.131.0/28" to let communicate between ibgp, there might have overlapping too as we already announcing 66.59.128.0/22. in the border router, there might have network 66.59.128.0/22 network 66.59.131.0/28 network 66.59.131.16/28 ls the command "redistributed connect" better? but this is border Router. We concern it will effect the upstream using redistributed connect Please help Thank you so much

2 1

[NANOG-announce] Appointment of Dan Golding as Board Member
by Sylvie LaPerriere 26 Jun '12

26 Jun '12

NANOG Colleagues, The Board has met last Friday June 22 and appointed Dan Golding as the replacement board member until the next election. He will join our next Board on July 6. We would like to thank everyone who submitted their candidacy for this interim. Your desire to serve is encouraging. We had previously announced that we would communicate this appointment on June 22. The delay is due to our desire to communicate personally with all that were not selected first. We trust you understand. Welcome Dan! Sincerely, -- Sylvie LaPerriere NANOG Chair - www.nanog.org _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0