Full Disclosure: Re: Worldnic DNS servers poisoned?

From: Florian Weimer <fw_at_deneb.enyo.de>
Date: Fri, 08 Feb 2008 10:07:26 +0100

* James Lay:

> ?
>
> [15:53:58 jlay_at_mail:~$] dig @205.178.190.13 www.google.com
>
> ; <<>> DiG 9.3.4-P1 <<>> @205.178.190.13 www.google.com
> ; (1 server found)
> ;; global options: printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32455
> ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;www.google.com. IN A
>
> ;; ANSWER SECTION:
> www.google.com. 7200 IN A 205.178.145.65

More likely they run an authoritative server with an A wildcard record
at the root. This is a common configuration when you don't want to
configure millions of individual zones with identical data on your name
servers.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Feb 08 2008