Re: Microsoft version.binding us now?

[jessen () NIC BR (Klaus Steding-Jessen)]

on Friday, 26 May 2000 19:11:36, Bill Marquette wrote:
| I've seen the following scan on some servers I admin for the last few days
| from not only 207.46.106.84 but also a couple other systems in that /24
| address space.  So far I've seen the version.bind hits about 50 times.  The
| really wierd thing is:
|
| we have two connections to the 'net
| our dns servers are split across the connections
| it's not a browser on the internal side triggering it as they're round
| robined via squid out the two connections
| ALL the attempts are to the same server.
|
| May 25 13:31:58 myhost named[1319]: 25-May-2000 13:31:58.126 security:
| notice: unapproved query from [207.46.106.84].42900 for "VERSION.BIND"
| May 25 13:31:58 myhost named[1319]: 25-May-2000 13:31:58.127 security:
| notice: unapproved query from [207.46.106.84].42900 for "VERSION.BIND"
| May 25 13:31:58 myhost named[1319]: 25-May-2000 13:31:58.128 security:
| notice: unapproved query from [207.46.106.84].42900 for "VERSION.BIND"
| May 25 13:54:07 myhost named[1319]: 25-May-2000 13:54:07.132 security:
| notice: unapproved query from [207.46.106.84].2623 for "VERSION.BIND"

Same thing here, from 207.46.106.75, 207.46.106.77 and 207.46.106.84:

May 25 16:16:27 foo named[39069]: unapproved query from [207.46.106.75].45294 for "VERSION.BIND"
May 25 16:43:40 foo named[39069]: unapproved query from [207.46.106.77].50702 for "VERSION.BIND"
May 25 17:37:08 foo named[39069]: unapproved query from [207.46.106.84].49823 for "VERSION.BIND"
May 25 17:38:30 foo named[39069]: unapproved query from [207.46.106.84].51197 for "VERSION.BIND"
May 25 17:41:30 foo named[39069]: unapproved query from [207.46.106.84].54255 for "VERSION.BIND"
May 25 18:29:57 foo named[39069]: unapproved query from [207.46.106.84].44706 for "VERSION.BIND"

The reply from infosec () microsoft com:

> From: ITG Information Security Center <infosec () microsoft com>
> Sender: Greg Galford <ggalford () microsoft com>
> Subject: FW: SECURITY: Hacking activity from your domain
> Date: Fri, 26 May 2000 07:31:42 -0700
> X-Mailer: Internet Mail Service (5.5.2651.58)
>
>
> Hi, these packets you are seeing are not probes, but are coming from
> an F5 networks product, 3dns (see:
> http://www.f5.com/3dns/index.html).

[snip]

Hard to believe that 3dns is using version.bind probes to collect RTT
information.  Can anyone confirm this?

Klaus.