This is most definitely a coordinated and planned attack.
And by 'attack' I mean hijacking of domain names.
I show as of this morning nearly fifty thousand domain names that appear
suspicious.
I'm tempted to call uscentcom and/or related agencies (which agencies, who
the hell knows, as ICE seems to have some sort of authority over domains
(nearly two hundred fifty of them as I type this in COM alone and another
thirty-some in NET).
Anyone credentialed (credentialed /n/., "I know you or know of you,")
wanting data, e-mail me off-list for some TLD goodness.
I'm rechecking realtime ns1620/2620 DNS right now and, looking at the
output, I see an odd number of domains (that have changed) with a listed
nameserver of "localhost.".
Poisoning a domain's NS records with localhost will most certainly DOS the
domain, yes.
I have not yet seen the source of this; if anyone has a clue where the
updates are coming from please post the info.
Is there anything about ztomy.com that has been seen that's supicious as in
they might be the origin? This could be them, or could be a joe-job
against them. I do not want to point a finger lacking any sort of actual
data dump of the poisoning activity...
Not so easy and straightforward to do. You'll find that a lot of the
big names out there frequently tweak DNS, which will result in a
non-stop stream of "alerts".
- Did someone gain access to the COM dispersion zone, or parts thereof?
- Did someone figure out how to [ insert theory here ] ?
I'm looking at domains that were solidly pointing at ztomy at 2:30AM (that
are 'recovered' to other nameservers) that show no "updates" in `whois`
records.
They must be staffed with physicists, astronomers, or economists.... I don't know anyone else that would consider "nearly fifty thousand" (from a previous post by Phil Fagan) to be a small number.
netsol says this is a human error incurred during DDOS mitigation. ztomy.com is a wild-card DNS provider that seems to use prolexic.
Now imagine someone at netsol or its DDOS service providers
fat-fingered their DDOS-averting routing in such a way that netsol
DNS traffic arrived at ztomy.com instead of a netsol server.
The ztomy.com server would know how to answer the queries...
Hello everyone, I'm new here.
+1 to this theory. I've been watching what's happening since 3am Eastern, because a domain of mine (of the many at NetSol) was a victim of this event.
So it's okay to screw over "nearly fifty thousand" customer domains because
there are 140M .com's? When talking about inadvertently effecting that
many folks I don't think it is appropriate to trivialize the customer
impact by calling it small when you're talking about a handful of large
websites that aren't somehow magically shared over those 140M .coms. Also
it is untrue to limit it to only "the websites" given how many other things
folks are likely to be using DNS for...
Ages ago I responded on a Cisco list where the topic was biggest screwup
you've made. I posted that I once forgot the implicit deny in an ACL and
accidentally blocked all traffic between 4 locations in 2 states for a
company I was working for. Downtime was a very brutal 60 seconds. Someone
very insightful responded with "anyone who hasn't done similar is lying
about the 10 years on their resume". So the real question would be, why
wasn't there someone who has already done this in the past working on this
zone?
I think you are reading it the wrong way. Mr.Kletnieks never said it
was okay. He just stated that the numbers were trivial when compared to
the rest of potential customers being affected.
Be cool, Richard Golodner
netsol screwed up. they screwed up bigtime. they are shoveling kitty
litter over it as fast as they can, and they have a professional kitty
litter, aka pr, department.
but none of this is surprising.
and dnssec did not save us. is there anything which could have?
....at what point is the Internet a piece of infrastructure whereby we
actually need a way to watch this thing holistically as it is one system
and not just a bunch of inter-jointed systems? Who's job is it to do
nothing but ensure that the state of DNS and other services is running as
it should....who's the clearing house here.
