Bugtraq mailing list archives
RE: International DNS compromise?
From: "Mike Clark" <mclark () Clearpathnet com>
Date: Fri, 6 Aug 2004 08:46:20 -0700
I've seen this before with companies that provide content for people in China. The last company I talked to about this used proxy servers and had people hosting content all over the country(US)to avoid the filtering/blocking by the Chinese government. It seemed to work pretty well. -Mike -----Original Message----- From: travis.alexander () lacamas org [mailto:travis.alexander () lacamas org] Sent: Thursday, August 05, 2004 10:37 AM To: zhenshi99 () yahoo com; bugtraq () securityfocus com Subject: RE: International DNS compromise? I got six different results, meaning six different server IP's. 1. 64.33.99.47 2. 207.12.88.98 3. 208.56.31.43 4. 216.221.188.182 5. 65.160.219.113 6. 65.104.202.252 All US owned IP addresses. Yes this is very interesting. So what does this mean, or potentially mean...? Travis. -----Original Message----- From: Zhen Shi [mailto:zhenshi99 () yahoo com] Sent: Wednesday, August 04, 2004 10:11 PM To: bugtraq () securityfocus com Subject: International DNS compromise? Dear all, Recently I noticed something fishy in the DNS system between US and China. First, any IPs, dead or live, in China will respond to your DNS query for some domains. For example (screen shot with some clean-up and comments): C:\>nslookup
server 210.77.0.0 <=== pick a random IP in
China Default Server: [210.77.0.0] Address: 210.77.0.0
www.rfa.org
Server: [210.77.0.0] Address: 210.77.0.0 Non-authoritative answer: Name: www.rfa.org Address: 203.105.1.21 <=== you got response!!!! Second, every time the response is different:
www.rfa.org
Server: [210.77.0.0] Address: 210.77.0.0 Non-authoritative answer: Name: www.rfa.org Address: 64.66.163.251
www.rfa.org
Non-authoritative answer: Name: www.rfa.org Address: 64.33.99.47
www.rfa.org
Non-authoritative answer: Name: www.rfa.org Address: 128.121.126.139 Third, you can even get response from non-exist host names:
nosuchhost.rfa.org
Server: [210.77.0.0] Address: 210.77.0.0 Non-authoritative answer: Name: nosuchhost.rfa.org Address: 65.104.202.252
nosuchhost.rfa.org
Non-authoritative answer: Name: nosuchhost.rfa.org Address: 64.33.99.47 What on earth is really going on here? It seems the DNS system is messed up between US and China, and its integrity is compromised. People can be unknowingly redirected to any where ... --Zhen __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo
Current thread:
- International DNS compromise? Zhen Shi (Aug 05)
- Re: International DNS compromise? john (Aug 05)
- Re: International DNS compromise? John Kinsella (Aug 05)
- <Possible follow-ups>
- Re: International DNS compromise? Troy (Aug 05)
- Re: International DNS compromise? Rio Martin. (Aug 06)
- Re: International DNS compromise? Danny (Aug 06)
- Re: International DNS compromise? John F. Waymouth (Aug 06)
- RE: International DNS compromise? travis . alexander (Aug 05)
- RE: International DNS compromise? Troy Monaghen (Aug 06)
- Re: International DNS compromise? bill (Aug 06)
- RE: International DNS compromise? Mike Clark (Aug 06)
- RE: International DNS compromise? Johan Nilsson (Aug 06)
- Re: International DNS compromise? Troy (Aug 06)