- Test - lists.nanog.org

TCP Syns to 445 and 11768
by Cheung, Rick 17 Jan '05

17 Jan '05

Hi. Anyone notice an increase of TCP Syns to port 11768, and 445 across random internet IPs? I googled the port, and found a similar posting here: http://www.trustedmatrix.org/portal/forum_viewtopic.php?7.954 We located the source on our network, updated DATs, and WindowsUpdate hotfixes, but the problem persists. ___________________________________________________________________ Thanks, Rick Cheung This message, including any attachments, contains confidential information intended for a specific individual and purpose and is protected by law. If you are not the intended recipient, please contact sender immediately by reply e-mail and destroy all copies. You are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The sender accepts no liability for any damage caused by any virus transmitted by this email. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

4 3

domain hijacking - what do you do to prepared?
by Gadi Evron 17 Jan '05

17 Jan '05

Until today, I considered this to be a real and relevant threat, although rather low in my matrix. As someone I know said today, now that kiddies saw how much "fun" this is, I am sure they will attempt this again. The question that comes to mind is - what do you do to be prepared? I suppose that other than setting registrar lock in place, there is another thing one can do. Study! Whether it's checking the expiration date for your domain, establishing contact with your up-in-line authority - registrar, tld, etc. depending on who you are. Having the relevant contact information at hand, establishing a set policy on how to handle such an incident and who to contact, bugging your next-in-chain about setting a policy on this with you, as well as setting such a policy for those who are slaves to you. That said, all that is left now is to see how this happened (so that it won't happen again - just killing a fire doesn't mean it won't be re-ignited) and perhaps think a bit on how we do things - which I am sure many will now do. Maybe this can be another discussion issue for the next NANOG get-together as well? Gadi.

4 3

Re: Regarding panix.com
by George William Herbert 17 Jan '05

17 Jan '05

>[...] >We are looking at our processes to ensure that incidents such as >occurred with panix.com can be addressed more quickly within Melbourne >IT, and also checking to ensure that an appropriate number of external >people have access to the right contacts at Melbourne IT to fast track >serious issues. Bruce, With all due respect, and I do appreciate that you guys worked dilligently to fix this once the right people there actually got the message, the overall performance of your organization appears to have been not just unacceptable, but grossly unacceptable. Having your CEO get the message, and then instead of notifying you to have him call your attorney who then tells Panix to go screw themselves until Monday morning, is so far beyond broken that I have to ask whether it's acceptable for your organization with its current staff to remain a registrar. I think that it's not unreasonable for me to suggest that the burden of proof is on Melbourne IT to demonstrate that you have fixed not only your technical and support contact issues, but that your CEO and corporate attorney have clearly demonstrated enough understanding of operational issues to continue to be associated with managing a public resource such as a registry. This was bad, and they made it worse. If they cannot or will not convince us (or, speaking for myself, me at least) that they have gotten a Clue, then please convey to your board of directors that I and certainly others will do whatever we can to see that your registrar status is revoked. -george william herbert gherbert(a)retro.com

1 0

[alexis@panix.com: Panix.com- Some brief comments on the hijacking of our domain]
by Thor Lancelot Simon 17 Jan '05

17 Jan '05

----- Forwarded message from Alexis Rosen <alexis(a)panix.com> ----- X-Original-To: tls(a)netbsd.org Delivered-To: tls(a)netbsd.org Resent-Message-Id: <200501170842.j0H8gWi21166(a)panix5.panix.com> X-Original-To: tls(a)panix.com Delivered-To: tls(a)rek.tjls.com Date: Mon, 17 Jan 2005 01:42:04 -0500 From: Alexis Rosen <alexis(a)panix.com> To: nanog(a)merit.edu Subject: Panix.com- Some brief comments on the hijacking of our domain User-Agent: Mutt/1.4.2.1i [Please note: I tried to post this five hours ago. It didn't make it, though I resubscribed to nanog-post (and acked the confirmation check) about half an hour previously. I'm resending (with light edits) and CCing this to a few friends; if any of you get this and see that it's not on nanog yet, please resend it for me. Thanks.] We're still digging out from under here, so I can't say nearly as much as I'd like. However, I have a few things that really need to be said sooner rather than later. (A couple of the later points are operational. Skip to "***" if you don't care who I'm grateful to...) First, I want to thank Martin Hannigan at Verisign. Whatever I may think of the (in)action I got from other parties there, he made significant efforts to get them to move, and the incomplete view of events that I have leads me to believe that it's his efforts, and the efforts of others at Verisign that he worked on, that got Melbourne IT to finally get off the dime. This was a very serious effort on his part, for someone who wasn't his direct customer, and I'm very appreciative of the concern and the effort. (This isn't to say that the immense efforts of other parties wasn't also helpful in this respect.) Secondly, I want to thank the MANY people here (and elsewhere), most of whom I don't know and have never had contact with, who devoted time and energy to this issue. Some I do know, and some of them were especially generous. You know who you are, but a partial list includes Thor Simon, Perry Metzger, Steve Bellovin, Bill Manning, and <hm, I don't know if I can say those names>. Thank you. Third (here's the "***"), I want to make a plea for those with operational control over large nameservers to reload their caches or expire out the panix.com entries from their caches, if they haven't yet picked up the correct data for our zone. (Note that having correct "NS" records isn't sufficient if you're caching all types.) The correct zones can be pulled from 198.7.0.1 or 198.7.0.2, for comparison's sake. If any of you have hand-copied our data into your DNS, please delete it so we're not afflicted by odd bits of stale data in the far future, when this incident is long forgotten. I noted something very odd earlier today. The A records for the hosts purporting to be mail.panix.com and mail2.panix.com were changed, with the last octets switched to ".0", making them unreachable. At the time I was grateful (because mail was being queued or bounced at the sender side, rather than bounced- and possibly copied- at the recipient side) but I didn't have time to try to figure out who had done what. I still don't know who/what was responsible, but I thank those who are, and just so I have a fuller understanding, I'd appreciate it if someone who knows what was done would contact me and fill me in. Someone here pointed out that we seem to have an SSH daemon running on port 80. That's intentional. It's on our shell hosts, and it's actually a clever bit of front-end code that switches web clients to a web server and ssh clients to the ssh daemon. It's for the benefit of customers who want to ssh in but are behind dumbass (or rightfully paranoid, take your pick) firewalls that don't allow out anything but connections to port 80. Thor and others have been commenting a bit on the fact that *something* is broken or compromised, either at MelbourneIT, Dotster, or Verisign. I hope that now that it's Monday morning in Australia, and will be in 12-15 hours here in the US, we can make some progress on figuring out what really happened. This would start with Verisign, Dotster, and MelbourneIT producing *all* relevant logs. I'll be discussing that with them tomorrow. There's a lot more to be said here, but for now we're going to finish cleaning up the mess, get the registry back to dotster, and try to catch up on some sleep. Oh, and work with various law enforcement types to try to catch the bastards responsible for this. /a --- Alexis Rosen President Public Access Networks Corp. - Panix.com alexis(a)panix.com Grand Central Server LLC. alexis(a)grandcentralserver.com ----- End forwarded message -----

1 0

panix.com in australian press
by Gadi Evron 17 Jan '05

17 Jan '05

http://www.theage.com.au/articles/2005/01/17/1105810810053.html && http://www.smh.com.au/articles/2005/01/17/1105810810053.html Gadi.

2 1

RE: Regarding panix.com
by Bruce Tonkin 17 Jan '05

17 Jan '05

Hello All, > > Melbourne IT restored the nameservers and contact details > associated with this name first thing this morning (Monday in > Melbourne, Australia). > > We are arranging with the previous registrar (Dotster) to > have the name transferred back. As an update, the transfer back has now been completed. Regards, Bruce

1 0

panix.com recovery in progress
by Henry Yen 17 Jan '05

17 Jan '05

The latest shell host motd's: . Hijack recovery underway (elr) Sun Jan 16 17:43:28 2005 . . Recovery is underway from the panix.com domain hijack. . . The root name servers now have the correct information, as does the . WHOIS registry. Portions of the Internet will still not be able to . see panix.com until their name servers expire the false data. More . info soon. . . panix.net status update (elr) Sun Jan 16 16:06:41 2005 . . As some of our customers have noticed, there have been a few problems . with using panix.net as a substitute for panix.com. We've fixed most . of them: . . * if you change your return address to username(a)panix.net, it now works. . Previously, it was getting re-written back to username(a)panix.com. Customers . may need to do this to send mail to domains that use "Sender Address . Verifcation" since the fake panix.com mail servers don't seem to be . accepting mail right now. . . * The URL "http://www.panix.net/~USERNAME" automatically redirects to . panix.com/~USERNAME. You can get around this by appending a / to the URL: . . http://www.panix.net/~USERNAME/ . . * Addresses of the form xxxx(a)USERNAME.users.panix.net are working now. . . Of course, we're still working around the clock to solve the underlying . problem with the hijacked domain. Also 'dig +trace panix.com. ns': ; <<>> DiG 9.2.4rc6 <<>> +trace panix.com. ns ;; global options: printcmd . 489907 IN NS K.ROOT-SERVERS.NET. . 489907 IN NS L.ROOT-SERVERS.NET. . 489907 IN NS M.ROOT-SERVERS.NET. . 489907 IN NS A.ROOT-SERVERS.NET. . 489907 IN NS B.ROOT-SERVERS.NET. . 489907 IN NS C.ROOT-SERVERS.NET. . 489907 IN NS D.ROOT-SERVERS.NET. . 489907 IN NS E.ROOT-SERVERS.NET. . 489907 IN NS F.ROOT-SERVERS.NET. . 489907 IN NS G.ROOT-SERVERS.NET. . 489907 IN NS H.ROOT-SERVERS.NET. . 489907 IN NS I.ROOT-SERVERS.NET. . 489907 IN NS J.ROOT-SERVERS.NET. ;; Received 292 bytes from 216.234.161.25#53(216.234.161.25) in 3 ms com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. ;; Received 499 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 143 ms panix.com. 172800 IN NS ns1.access.net. panix.com. 172800 IN NS ns2.access.net. ;; Received 105 bytes from 192.5.6.30#53(a.gtld-servers.net) in 57 ms -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

4 3

Re: Panix.com should be back.
by Hannigan, Martin 17 Jan '05

17 Jan '05

Thanks Fared for your assistance. Ypu are great among a bunch of helpers. Cheers, -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: nanog list <nanog(a)merit.edu> Sent: Sun Jan 16 19:57:54 2005 Subject: Panix.com should be back. I see that DNS changes has been reverted http://www.dnsreport.com/tools/dnsreport.ch?domain=panix.com I have also contacted our Customer owner of ns1.ukdnsservers.co.uk [panix.com] (142.46.200.67) they have assured me they will remove the DNS config as well. Sorry for the last response I was away for weekend. -- Majid Farid Telecom Ottawa Limited. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gadi Evron Sent: Sunday, January 16, 2005 7:24 PM To: nanog list Subject: domain hijacking - what do you do to prepared? Until today, I considered this to be a real and relevant threat, although rather low in my matrix. As someone I know said today, now that kiddies saw how much "fun" this is, I am sure they will attempt this again. The question that comes to mind is - what do you do to be prepared? I suppose that other than setting registrar lock in place, there is another thing one can do. Study! Whether it's checking the expiration date for your domain, establishing contact with your up-in-line authority - registrar, tld, etc. depending on who you are. Having the relevant contact information at hand, establishing a set policy on how to handle such an incident and who to contact, bugging your next-in-chain about setting a policy on this with you, as well as setting such a policy for those who are slaves to you. That said, all that is left now is to see how this happened (so that it won't happen again - just killing a fire doesn't mean it won't be re-ignited) and perhaps think a bit on how we do things - which I am sure many will now do. Maybe this can be another discussion issue for the next NANOG get-together as well? Gadi.

2 1

Panix.com should be back.
by Majid Farid 17 Jan '05

17 Jan '05

I see that DNS changes has been reverted http://www.dnsreport.com/tools/dnsreport.ch?domain=panix.com I have also contacted our Customer owner of ns1.ukdnsservers.co.uk [panix.com] (142.46.200.67) they have assured me they will remove the DNS config as well. Sorry for the last response I was away for weekend. -- Majid Farid Telecom Ottawa Limited. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gadi Evron Sent: Sunday, January 16, 2005 7:24 PM To: nanog list Subject: domain hijacking - what do you do to prepared? Until today, I considered this to be a real and relevant threat, although rather low in my matrix. As someone I know said today, now that kiddies saw how much "fun" this is, I am sure they will attempt this again. The question that comes to mind is - what do you do to be prepared? I suppose that other than setting registrar lock in place, there is another thing one can do. Study! Whether it's checking the expiration date for your domain, establishing contact with your up-in-line authority - registrar, tld, etc. depending on who you are. Having the relevant contact information at hand, establishing a set policy on how to handle such an incident and who to contact, bugging your next-in-chain about setting a policy on this with you, as well as setting such a policy for those who are slaves to you. That said, all that is left now is to see how this happened (so that it won't happen again - just killing a fire doesn't mean it won't be re-ignited) and perhaps think a bit on how we do things - which I am sure many will now do. Maybe this can be another discussion issue for the next NANOG get-together as well? Gadi.

3 2

RE: Panix.com should be back.
by Majid Farid 17 Jan '05

17 Jan '05

I regret not being around earlier. -- Majid -----Original Message----- From: Hannigan, Martin [mailto:hannigan@verisign.com] Sent: Sunday, January 16, 2005 11:03 PM To: Majid Farid; 'nanog(a)merit.edu' Subject: Re: Panix.com should be back. Thanks Fared for your assistance. Ypu are great among a bunch of helpers. Cheers, -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: nanog list <nanog(a)merit.edu> Sent: Sun Jan 16 19:57:54 2005 Subject: Panix.com should be back. I see that DNS changes has been reverted http://www.dnsreport.com/tools/dnsreport.ch?domain=panix.com I have also contacted our Customer owner of ns1.ukdnsservers.co.uk [panix.com] (142.46.200.67) they have assured me they will remove the DNS config as well. Sorry for the last response I was away for weekend. -- Majid Farid Telecom Ottawa Limited. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Gadi Evron Sent: Sunday, January 16, 2005 7:24 PM To: nanog list Subject: domain hijacking - what do you do to prepared? Until today, I considered this to be a real and relevant threat, although rather low in my matrix. As someone I know said today, now that kiddies saw how much "fun" this is, I am sure they will attempt this again. The question that comes to mind is - what do you do to be prepared? I suppose that other than setting registrar lock in place, there is another thing one can do. Study! Whether it's checking the expiration date for your domain, establishing contact with your up-in-line authority - registrar, tld, etc. depending on who you are. Having the relevant contact information at hand, establishing a set policy on how to handle such an incident and who to contact, bugging your next-in-chain about setting a policy on this with you, as well as setting such a policy for those who are slaves to you. That said, all that is left now is to see how this happened (so that it won't happen again - just killing a fire doesn't mean it won't be re-ignited) and perhaps think a bit on how we do things - which I am sure many will now do. Maybe this can be another discussion issue for the next NANOG get-together as well? Gadi.

1 0