Major DNS cache poisoning at Verisign/WorldNIC

From: Matthew F. Caldwell (mattcat_private)
Date: Tue Mar 19 2002 - 11:18:56 PST

Next message: Todd Suiter: "increase in scans for RPC"

Previous message: Kyle R. Hofmann: "Re: Question about HTTP DDOS attacks."
Next in thread: Brian McWilliams: "Re: Major DNS cache poisoning at Verisign/WorldNIC"
Reply: Brian McWilliams: "Re: Major DNS cache poisoning at Verisign/WorldNIC"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Just to let everyone know, there has been some major DNS cache poisoning going on at Verisign apparently done by some Brazilians ("Web Pirates") for web site defacements. If your parking your DNS at worldnic.com (netsol/verisign) you might want to see if you site has been redirected to 64.225.154.175 (owned by Interland of Atlanta) using random DNS servers. 

Don't you love UDP.

Matthew F. Caldwell, CISSP 
Chief Security Officer 
GuardedNet, Inc 


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Todd Suiter: "increase in scans for RPC"
Previous message: Kyle R. Hofmann: "Re: Question about HTTP DDOS attacks."
Next in thread: Brian McWilliams: "Re: Major DNS cache poisoning at Verisign/WorldNIC"
Reply: Brian McWilliams: "Re: Major DNS cache poisoning at Verisign/WorldNIC"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Mar 19 2002 - 14:14:28 PST