- Test - lists.nanog.org

RE: how to protect name servers against cache corruption
by Dan Dale 30 Jul '97

30 Jul '97

Jeesh people... let's get some life here. Step out and enjoy the weekend will ya??? Upgrade to BIND 8.1.1 and deal with it. Some hack will figure it out and 9.0 will soon be on it's way. DD -----Original Message----- From: Paul A Vixie [SMTP:vixie@vix.com] Sent: Tuesday, July 29, 1997 6:09 PM To: tqbf(a)enteract.com Cc: nanog(a)merit.edu Subject: Re: how to protect name servers against cache corruption > > Noone in the security field has any right to expect any implementation of > > DNS to be secure until DNSSEC is widely implemented. > > > I'm sorry if something I said misled you to believe otherwise. > > So BIND 8.1.1 is NOT "immune" to the poisoned resource-record attack? I > ask because you specifically stated that it was. Sorry to nag, I'd just > like to see this clarified to the operations community. BIND 4.9.6 and 8.1.1 are immune to all known attacks, including the one Eugene Kashpureff copied and put into wide public use recently. I know of attacks we are not immune to, which cannot be stopped without DNSSEC. My paper, whose URL I gave in the previous message, alludes to some of these without exactly giving a road map for their use.

1 0

Tracking cracker, help?
by dlr＠bungi.com 30 Jul '97

30 Jul '97

I'm tracking down an individual that has attacked both my personal site, as well as one of my customers' sites. In this particular attempt, when his 'normal' site was blocked by IP address, he immediately started to use dial-up sites all over his local area, then ranged further into the US. On my system, he had installed a password sniffer. I suspect that this was a common mode of operation for him. Naturally, I logged all of the attempts at the router level. I emailed the logs to the origin ISPs, and (with one notable exception) was met with huge indifference. In the queries, I am asking only for a confirm/deny of the user's name - I am not asking the ISP's involved to release the name of the dialup users. That, of course, will come later. Right now, I'm just trying to confirm that the same individual is launching the attacks. A police report has been filed, and a restraining order will be served tommorow. What's a better way to ask for, and obtain log information in a timely fashion? Wait 6 months for a court trial, when everyone has purged their logs? Clues would be appreciated. -- Dave Rand dlr(a)bungi.com http://www.bungi.com

5 4

Re: how to protect name servers against cache corruption
by Francois Beauregard 30 Jul '97

30 Jul '97

At 22:13 97-07-29 -0400, Perry E. Metzger wrote: > >Paul has made it clear that there are holes in the DNS protocols that >cannot be fixed without DNSSEC. He isn't papering anything over -- he >is merely describing reality. If you want to be sarcastic to him for >doing his best and being honest in public, well, that's fine, but >frankly I think you are doing the community a serious disservice by >attacking Paul. 110% behind you on that one... Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

NSI bulletin 097-005 | Reissuing deleted domain names
by David H. Holtzman 30 Jul '97

30 Jul '97

Effective immediately, Network Solutions will reinstitute deletion of unpaid domain names. Dave

3 2

Check me on this...
by Eric Germann 29 Jul '97

29 Jul '97

Its tuesday Jul 29,1997 at 3:00pm EDT ( a weekday in the US, correct? ) f.root-servers.net is still returning 1997072500 as a S/N instead of 1997072800 like all the rest, and bogus data about some zones. 4.5 hours ago I sent mail to Internic. No acknowledgement and no fix, so maybe they will hear it here. I will not respond to politics on the list if everyone else doesn't either :) Eric

4 3

Re: Check me on this...
by Eric Germann 29 Jul '97

29 Jul '97

Maybe a page with "We noticed a problem with xxxxx and we're working on it!" http://www.internic.net/current-issues.html as a suggestion. On second thought, maybe a well known page at each provider wouldn't be bad... Would certainly cut down my rants on the lists, and probably everyone elses. Eric At 04:26 PM 7/29/97 -0400, Jordan Mendelson wrote: >On Tue, 29 Jul 1997, Eric Germann wrote: > >> Its tuesday Jul 29,1997 at 3:00pm EDT ( a weekday in the US, correct? ) > >Hmm, nope... > >Last week, Senate passed a new bill removing the existance of weekdays so >that they could slack off and do less work. > >> f.root-servers.net is still returning 1997072500 as a S/N instead of >> 1997072800 like all the rest, and bogus data about some zones. > >I think a few people have reported this... > >> 4.5 hours ago I sent mail to Internic. No acknowledgement and no fix, so >> maybe they will hear it here. > >They REALLY need some people full time to respond to email. I hate sending >my email into "The Blackhole of Death" which is InterNIC's mail system. > > >Wow, a valid InterNIC warning... go figure. > > >Jordan > >-- >Jordan Mendelson : www.wserv.com/~jordy/ >Web Services, Inc. : www.wserv.com > > > >

1 0

Re: Check me on this...
by Eric Germann 29 Jul '97

29 Jul '97

Just checking. At 12:37 PM 7/29/97 -0700, Paul A Vixie wrote: >NSI noticed this hours ago and has been in contact with me. > > ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0

Re: Earth-moving trivia (was "RE: "1997, the Year of the Backhoe" ...Re: Fiber Cut In Sterling VA.""
by brandon＠rd.bbc.co.uk 29 Jul '97

29 Jul '97

> In case the UK has got bored and gone home.... No, now the suits have gone home we're busy getting some real work done. Brandon

1 0

RE: "1997, the Year of the Backhoe" ...Re: Fiber Cut In Sterling VA.
by Bill Woodcock 29 Jul '97

29 Jul '97

Peter Galbavy writes: > Thanks for that folks. > I now know that "backhoe" == "JCB". :) So please indulge those of us unfamiliar with the finer points of British outside-plant cable-management... What does "JCB" stand for? -Bill ______________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)nowhere.loopback.edu user(a)host.domain.com

4 3

MCI-Bloomington
by Taner Halicioglu 29 Jul '97

29 Jul '97

So, anyone have a better story (or more info )than "major problems in Rialto" :-) Looks like it could either be a massive router failure, or a(nother) fiber cut, since I can't seem to get to any of the Bloomington routers... Anyone have more info? -Taner -- D. Taner Halicioglu taner(a)isi.net Programmer/Engineer/Sysadmin ISI / GlobalCenter Voice: +1 408 543 0313 Fax: +1 408 541 9878 PGP Fingerprint: 65 0D 03 A8 26 21 6D B8 23 3A D6 67 23 6E C0 36

3 3