nanog mailing list archives
Re: Craigslist hacked?
From: Mark Andrews <marka () isc org>
Date: Tue, 25 Nov 2014 12:00:05 +1100
In message <FDF98A3E-6BDC-4D85-8826-B3B8DC6EC725 () gmail com>, George Herbert writes:
On Nov 24, 2014, at 4:18 PM, Randy Epstein <nanog () hostleasing net>wrote:Actually, he didnât hack its records either. He exploited a bug inBIND. ...returned a legit response plus a tacked-on glue record for www.internic.net anytime you queried his nameserver, which he tricked people into doing with mixtures of sending you mail, hitting open DNS servers with queries for his domain, and another thing I still don't want to talk about. Paul was more widely quoted and knew his BIND vulnerability better; he can always out-pedant me on this one.
More a protocol bug which lead to DNSSEC, which allows you to accept a answer from anywhere so long as it is signed and validates as secure, which most of you have yet to deploy.
I did get a few press quotes, though. Your fu is weak, Randyhopper. Train harder! ;-) George William Herbert Sent from my iPhone
-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka () isc org
Current thread:
- Re: Craigslist hacked?, (continued)
- Re: Craigslist hacked? Brian Henson (Nov 24)
- Re: Craigslist hacked? Randy Epstein (Nov 24)
- It's 7pm. Do you know where *your* domains are? (was Re: Craigslist hacked?) Jay Ashworth (Nov 24)
- Re: It's 7pm. Do you know where *your* domains are? (was Re: Craigslist hacked?) Josh Luthman (Nov 24)
- Re: It's 7pm. Do you know where *your* domains are? (was Re: Craigslist hacked?) Miles Fidelman (Nov 24)
- Re: It's 7pm. Do you know where *your* domains are? (was Re: Craigslist hacked?) Mike Hale (Nov 24)
- Re: It's 7pm. Do you know where *your* domains are? (was Re: Craigslist hacked?) Gregg Berkholtz (Nov 25)
- Re: Craigslist hacked? George Herbert (Nov 24)
- Re: Craigslist hacked? Randy Epstein (Nov 24)
- Re: Craigslist hacked? George Herbert (Nov 24)
- Re: Craigslist hacked? Mark Andrews (Nov 24)
- Re: Craigslist hacked? Mark Andrews (Nov 24)
- Re: Craigslist hacked? Randy Epstein (Nov 24)
- Re: Craigslist hacked? Mark Andrews (Nov 24)
- Re: Craigslist hacked? George Herbert (Nov 24)
- Re: Craigslist hacked? Randy Epstein (Nov 24)
- Re: Craigslist hacked? Ken Chase (Nov 23)
- Re: Craigslist hacked? Brian Henson (Nov 23)
- Re: Craigslist hacked? Josh Luthman (Nov 23)