[ILUG] Re: domain-jacking

[Colin Whittaker]

Robert Elliott stated the following on Mon, Jan 10, 2000 at 06:24:51PM +0000 :
> Howdy, all.
> A couple of rather bizarre lines appeared in my logs today:
> Jan 10 05:53:11 leviathan named[27650]: approved AXFR from
> [209.112.56.46].3680 for "irelands-web.ie"
> Jan 10 05:53:11 leviathan named[27650]: zone transfer (AXFR) of
> "irelands-web.ie" (IN) to [209.112.56.46].3680
> 
> >From what I gather from the scant information I can find on the web, if
> this is deliberate it's probably a precursor to a cracking attempt
> rather than a heinous plot to nick our domain. In any case, it's not the
> sort of thing I like to see appearing in the logs. So:
> 1. Does anyone know what's happening?

Someone ran host -l against your domain or a similar command.
This transfers the zone data so the list of all the hosts in the zone
can be listed along with things like HINFO fields etc..

> 2. Does anyone know how to stop it?

Configure named to only zone transfers form specific hosts, ie the other
nameservers for your domain.

> 3. What is port 3680?

random port used by what ever software did the transfer, unix boxes tend
to select the source port at random form somewhere above 1024.
 
> 209.112.56.46 is compuoffice.com ; I imagine they're innocent bystanders
> in all this. 

Reading data out of a public database aint exactly a crime you know.

-- 
                    +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+
                    |  "Crystalline perfection is brittle"  |
                    +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+