Re: FW: [Full-Disclosure] Question for DNS pros
From: Frank Knobbe (frank_at_knobbe.us)
Date: 08/04/04
- Previous message: idlabs-advisories_at_idefense.com: "[Full-Disclosure] iDEFENSE Security Advisory 08.03.04b: NGSEC StackDefender 2.0 Invalid Pointer Dereference Vulnerability"
- In reply to: Frank Knobbe: "Re: FW: [Full-Disclosure] Question for DNS pros"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: fd@mchsi.com Date: Tue, 03 Aug 2004 18:20:52 -0500
On Tue, 2004-08-03 at 17:52, Frank Knobbe wrote:
> 216.154.239.240 - SBC in Irvine
--> couldn't confirm that one
> 66.150.165.7 - Logical US-AWS NAP through Internap
--> seadns01.shopattwireless.com (match)
> 64.170.177.10 - SBC Interactive through PacBell
--> 64-170-177-10.ptim.com (match)
> 63.240.26.10 - CERFnet
--> ny-ns.marketwatch.com (match)
> 63.210.252.135 - Level 3
--> cindns01.shopattwireless.com (match)
(match means it is the exact same traffic, just a low volume, between 3
and 10 packets total).
It appears all these are DNS servers. They also all respond to queries
for "." with the list of root servers. That means that they are
recursive.
Perhaps there is a 0-day exploit for certain DNS servers? Maybe those
DNS servers have a worm that is trying to spread? Maybe seeded from
China? Otherwise, why would AT&T's name server be sending out probes?
The mystery deepens...
Regards,
Frank
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- application/pgp-signature attachment: This is a digitally signed message part
- Previous message: idlabs-advisories_at_idefense.com: "[Full-Disclosure] iDEFENSE Security Advisory 08.03.04b: NGSEC StackDefender 2.0 Invalid Pointer Dereference Vulnerability"
- In reply to: Frank Knobbe: "Re: FW: [Full-Disclosure] Question for DNS pros"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
