Re: DNS poisoning at Google?

2012-06-27 Thread Grant Ridder
It also redirects with facebook, youtube, and ebay but NOT amazon. -Grant On Wed, Jun 27, 2012 at 12:57 AM, Matthew Black matthew.bl...@csulb.eduwrote: Our web lead was able to run curl. Thanks. ** ** matthew black information technology services california state

Re: DDI (DNS+DHCP+IPAM) Solutions

2012-06-27 Thread Måns Nilsson
Subject: DDI (DNS+DHCP+IPAM) Solutions Date: Tue, Jun 26, 2012 at 07:37:36PM -0700 Quoting Eric Cables (ecab...@gmail.com): I'm looking to consolidate DNS/DHCP/IPAM into a single tool. Today I use IPPlan for IPAM, and have been reasonably happy with it over the last 5+ years, but I'd like to

RE: DNS poisoning at Google?

2012-06-27 Thread Matthew Black
We found the aberrant .htaccess file and have removed it. What a mess! matthew black information technology services california state university, long beach From: Grant Ridder [mailto:shortdudey...@gmail.com] Sent: Tuesday, June 26, 2012 11:02 PM To: Matthew Black; nanog@nanog.org Cc: Jeremy

Re: DNS poisoning at Google?

2012-06-27 Thread Bryan Irvine
The fun part will be figuring out how it got there. :) Sent from my iPhone On Jun 27, 2012, at 12:06 AM, Matthew Black matthew.bl...@csulb.edu wrote: We found the aberrant .htaccess file and have removed it. What a mess! matthew black information technology services california state

RE: DNS poisoning at Google?

2012-06-27 Thread Ian McDonald
Ahh, but how did it get there in the first place. Matthew, meet can of worms. I presume you have an opener. -- ian -Original Message- From: Matthew Black Sent: 27/06/2012, 08:07 To: Grant Ridder; nanog@nanog.org Cc: Jeremy Hanmer Subject: RE: DNS poisoning at Google? We found the

Re: DNS poisoning at Google?

2012-06-27 Thread Ishmael Rufus
I'll take files that shouldn't have level 7 permissions for $400 alex. On Wed, Jun 27, 2012 at 2:09 AM, Bryan Irvine sparcta...@gmail.com wrote: The fun part will be figuring out how it got there. :) Sent from my iPhone On Jun 27, 2012, at 12:06 AM, Matthew Black matthew.bl...@csulb.edu

Re: strat-1 gps

2012-06-27 Thread Randy Bush
my experience with cdma was kinda funky and there already is a fancy gps antenna randy

Re: DNS poisoning at Google?

2012-06-27 Thread Michael J Wise
On Jun 27, 2012, at 12:06 AM, Matthew Black wrote: We found the aberrant .htaccess file and have removed it. What a mess! Trusting you carefully noted the date/time stamp before removing it, as that's an important bit of forensics. Aloha, Michael. -- Please have your Internet License

Re: strat-1 gps

2012-06-27 Thread bmanning
i've been using a earlier version of this: http://www.spectracomcorp.com/ProductsServices/TimingSynchronization/NetworkTimeServers/9483NetClockTimeServer/tabid/1439/Default.aspx On Tue, Jun 26, 2012 at 09:35:29PM -1000, Randy Bush wrote: my experience with cdma was kinda funky and there

No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Stephane Bortzmeyer
On Wed, Jun 27, 2012 at 03:53:17AM +, Matthew Black matthew.bl...@csulb.edu wrote a message of 18 lines which said: We believe the DNS servers used by Google's crawler have been poisoned. [After reading the whole thread and discovering that Google was indeed right.] What made you think

Re: DDI (DNS+DHCP+IPAM) Solutions

2012-06-27 Thread Jethro R Binks
On Tue, 26 Jun 2012, Eric Cables wrote: I'm looking to consolidate DNS/DHCP/IPAM into a single tool. Today I use IPPlan for IPAM, and have been reasonably happy with it over the last 5+ years, but I'd like to leverage the benefits of integrating DNS and DHCP for real-time information,

Re: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Daniel Rohan
On Wed, Jun 27, 2012 at 10:50 AM, Stephane Bortzmeyer bortzme...@nic.frwrote: What made you think it can be a DNS cache poisoning (a very rare event, despite what the media say) when there are many much more realistic possibilities (trollspecially for a Web site written in PHP/troll)? What

Re: DNS poisoning at Google?

2012-06-27 Thread TR Shaw
On Jun 27, 2012, at 3:36 AM, Michael J Wise wrote: On Jun 27, 2012, at 12:06 AM, Matthew Black wrote: We found the aberrant .htaccess file and have removed it. What a mess! Trusting you carefully noted the date/time stamp before removing it, as that's an important bit of forensics.

New I-D on SLAAC DNS configuration problems (Fwd: New Version Notification for draft-gont-6man-slaac-dns-config-issues-00.txt)

2012-06-27 Thread Fernando Gont
Folks, We have published a new Internet-Draft entitled Current issues with DNS Configuration Options for SLAAC. This draft if meant to address the SLAAC DNS configuration issues raised by Pavel on the 6man mailing-list, and also discusses other potential issues. The I-D is available at:

NANOG 56 - Dallas, TX: Call For Presentations

2012-06-27 Thread David Temkin
NANOG Community, After a great NANOG in Vancouver, BC, the survey results are in from 55 and we are already assembling a world-class program for NANOG 56. The North American Network Operators' Group (NANOG) will hold its 56th meeting in Dallas, TX on October 21 - 23, 2012 and join with ARIN

Re: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Arturo Servin
It was not DNS issue, but it was a clear case on how community-support helped. Some of us may even learn some new tricks. :) Regards, as Sent from mobile device. Excuse brevity and typos. On 27 Jun 2012, at 05:07, Daniel Rohan dro...@gmail.com wrote: On Wed, Jun 27, 2012 at 10:50 AM,

Re: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Jason Hellenthal
What would be nice is the to see the contents of the htaccess file (obviously with sensitive information excluded) On Wed, Jun 27, 2012 at 10:14:12AM -0300, Arturo Servin wrote: It was not DNS issue, but it was a clear case on how community-support helped. Some of us may even learn some

Re: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Ryan Rawdon
On Jun 27, 2012, at 9:26 AM, Jason Hellenthal wrote: What would be nice is the to see the contents of the htaccess file (obviously with sensitive information excluded) I cleaned up compromises similar to this in a customer site fairly recently. In our case it was the same exact behavior

Re: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Ryan Rawdon
On Jun 27, 2012, at 10:10 AM, Ryan Rawdon wrote: On Jun 27, 2012, at 9:26 AM, Jason Hellenthal wrote: What would be nice is the to see the contents of the htaccess file (obviously with sensitive information excluded) I cleaned up compromises similar to this in a customer site

Re: DNS poisoning at Google?

2012-06-27 Thread AP NANOG
This may not help Matt now, but I just came across this today and believe it may help others who have to deal with incidents: http://cert.societegenerale.com/en/publications.html -- IRM (Incident Response Methodologies) If you changed the file contents before noting the created date,

RE: DNS poisoning at Google?

2012-06-27 Thread Matthew Black
Yes, we did that and also noted the username and IP address from where the FTP upload originated. matthew black information technology services california state university, long beach -Original Message- From: Michael J Wise [mailto:mjw...@kapu.net] Sent: Wednesday, June 27, 2012

RE: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Matthew Black
Ask and ye shall receive: # more .htaccess (backup copy) #c3284d# IfModule mod_rewrite.c RewriteEngine On RewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|alt

RE: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread Matthew Black
By the way, FTP access originated from: 208.88.11.111 Sky Wire Communications SKYWIRE-SG (NET-208-88-8-0-1) 208.88.8.0 - 208.88.11.255 NetRange: 208.88.8.0 - 208.88.11.255 CIDR: 208.88.8.0/22 OriginAS: AS40603 NetName:SKYWIRE-SG NetHandle: NET-208-88-8-0-1

Re: No DNS poisoning at Google (in case of trouble, blame the DNS)

2012-06-27 Thread AP NANOG
On 6/27/12 12:51 PM, Matthew Black wrote: Ask and ye shall receive: # more .htaccess (backup copy) #c3284d# IfModule mod_rewrite.c RewriteEngine On RewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|alt

Re: DNS poisoning at Google?

2012-06-27 Thread Bryan Irvine
On Wed, Jun 27, 2012 at 9:48 AM, Matthew Black matthew.bl...@csulb.edu wrote: Yes, we did that and also noted the username and IP address from where the FTP upload originated. It came from an FTP upload? Why I outta ... ;-)

[NANOG-announce] Announcing a Monday to Wednesday NANOG Program Starting at NANOG 57 (Feb 2013)

2012-06-27 Thread Sylvie LaPerriere
Colleagues, At our NANOG 55 Community meeting Dave Temkin presented the PC proposal to move our Conference Program to a Monday-to-Wednesday format. Originating from the community, this proposal was developed and refined in the last year using the conference surveys. We surveyed you one last time