Re: DNS poisoning block list?

From: Bit Twister (BitTwister_at_mouse-potato.com)
Date: 04/06/05 

Date: Wed, 06 Apr 2005 03:31:07 -0500

On Wed, 06 Apr 2005 01:51:29 -0400, Newsbox wrote:
>
> So we have multiple Zero days, but my thought is to make their Zero days
> shorter.

But you were hinting it came from someone's list. They will not show up
on the list until it is tooo late. Even the sans report indicated
several of the posioned .coms would not allow their name to be mentioned.
And it was a week before the site ip showed up because they did not
want the blackhat to know they were on to them.

> I don't want them to snatch my snatch at all, but if it is 3
> minutes (might be more than enough for them), and if I can wait 4 minutes
> for some magic to work, then I can beat them. That's all that I need.

Guess you type your login/id kinda slow if you need a 4 minute window
at some web site. :-)

> Please tell more about your script (MUCH more!) And thanks.

You can snatch a copy of ckip.pl at
http://double_null_bucket.home.comcast.net/ I munged it up to run on
windows for friends, so you will have to change the first line to
suit your system.

> I noticed the yahoo.com anomaly myself, but didn't know how to react. It
> all came back into line after a while. Was this due to DNS poisoning, do
> you think? Was there harm done? What is your view, please?

I was guessing they were in the mist of server shuffle becase it has
been solid since, with the new/current values. I had seen other bank
login server ip move in and out depending on time of day.
I guessed a server ip toggled when the login load was high.

When my browser would not launch I would keep running the script to
see what was going on and was doing reverse lookups to see if they
were matching. I still waited until the value settled down before
logging into the site.

> What, please, are the underlying poison-unpoison mechanisms that need to
> be corrected to get out of all this? Asking from a single user's
> background.

Not much us end users can do about it. Hopefully ipv6 will keep this
from happening in the future.

> And is there any expectation in your view that a blocklist, already
> established or new, could be useful in preventing requests to mal-sites?

You have seen my zero day view on lists. You load a bunch of ip
addresses into your iptables and it is going to get dead dog slow.

I hate ad and ad tracking sites. My solution to that is to add them
to my /etc/hosts file to block them. Very small snippet follows:

127.0.0.2 aboutwebservices.com
127.0.0.2 abroadsoftware.com
127.0.0.2 absoluagency.com
127.0.0.2 acc.adintelligence.net

Host file additions will not require a iptables or network reboot to
take effect.

You need to think about you automagich system change very carefully.
The yahoo.com is a good example.

Relevant Pages

  • Réf. : [Linux-usb-users] Re: USB/HID UPS issue (was Re: USB scanner issue)
    ... > where the entire structure is ZERO, ... >Or how to report them to the USB people if you cant post to the USB lists? ... send the line "unsubscribe linux-kernel" in ...
    (Linux-Kernel)
  • Re: A Logical Model for Lists as Relations
    ... Relations are sets, lists aren't. ... > By the way in modern math, naturals do include zero (von Neumann ... >>For lists, you need bunch theory, not set theory. ...
    (comp.databases.theory)
  • Re: need help with lists
    ... i need to get a list containing 3 lists using the following strategy: ... and if it is zero, it should be placed to the second sublist. ... i should get the following list containing 3 sublists: ... 'nil nil) ...
    (comp.lang.lisp)
  • Re: Cantors Theory sucks
    ... >>> definitely is grounded in reality. ... they really exist only in our minds, and therefore mathematics ... You say zero does not exist. ... say so, I will tell you that lists do not exist in the world, ...
    (sci.math)
  • Re: Functions
    ... > Rounds a number (away from zero) to the nearest even integer. ... > Excel and Word Function Lists ...
    (microsoft.public.excel.misc)