full-disclosure - Re: Worldnic DNS servers poisoned?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 08 Feb 2008 10:07:26 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: James Lay <jlay@...ve-tothe-box.net>
Cc: Full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Worldnic DNS servers poisoned?

* James Lay:

> ?
>
> [15:53:58 jlay@...l:~$] dig @205.178.190.13 www.google.com
>
> ; <<>> DiG 9.3.4-P1 <<>> @205.178.190.13 www.google.com
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32455
> ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;www.google.com.                        IN      A
>
> ;; ANSWER SECTION:
> www.google.com.         7200    IN      A       205.178.145.65

More likely they run an authoritative server with an A wildcard record
at the root.  This is a common configuration when you don't want to
configure millions of individual zones with identical data on your name
servers.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/