What's the query. Could it be related to
http://www.isc.org/software/bind/advisories/cve-2011-4313?
On Thu, Jan 26, 2012 at 6:35 AM, J. von Balzac <jhm.balzac (at) gmail (dot) com [email concealed]> wrote:
> I'm seeing a lot of hosts in my named logs (I mean log files, it's not
> like I am naming my poop)
>
> ...ok... silly joke hehe
>
> So anyway, named bind is reporting a lot of denied queries of type
> 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
> is to immediately block the IPs for port 53 after as few as one denied
> query) - but I want to warn server admins who haven't spotted both
> these queries and other denied queries.
>
> Common sense suggests that these hosts are probably spoofed IPs. Looks
> like an effective way to ddos a host: request an arbitrary DNS record
> with a spoofed IP and let the server reply to the spoofed IP in
> whatever way. Do that with many hosts and there is your denial of
> service.
>
> A side effect is that when you block the IP, you're blocking something
> that isn't really doing anything wrong as it's a spoofed IP
>
> But ok, I'm not too sure of this so please shoot holes in my theory or
> suggest better fixes/workarounds/...
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
http://www.isc.org/software/bind/advisories/cve-2011-4313?
On Thu, Jan 26, 2012 at 6:35 AM, J. von Balzac <jhm.balzac (at) gmail (dot) com [email concealed]> wrote:
> I'm seeing a lot of hosts in my named logs (I mean log files, it's not
> like I am naming my poop)
>
> ...ok... silly joke hehe
>
> So anyway, named bind is reporting a lot of denied queries of type
> 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
> is to immediately block the IPs for port 53 after as few as one denied
> query) - but I want to warn server admins who haven't spotted both
> these queries and other denied queries.
>
> Common sense suggests that these hosts are probably spoofed IPs. Looks
> like an effective way to ddos a host: request an arbitrary DNS record
> with a spoofed IP and let the server reply to the spoofed IP in
> whatever way. Do that with many hosts and there is your denial of
> service.
>
> A side effect is that when you block the IP, you're blocking something
> that isn't really doing anything wrong as it's a spoofed IP
>
> But ok, I'm not too sure of this so please shoot holes in my theory or
> suggest better fixes/workarounds/...
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1
------------------------------------------------------------------------
[ reply ]