Berkeley CSUA MOTD:Entry 50638
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/04/04 [General] UID:1000 Activity:popular
4/4     

2008/7/20-23 [Computer/Domains] UID:50638 Activity:nil
7/19    Why is OpenDNS popular? It still forwards me to ads when I go
        to an invalid domain. That is really annoying.
        \_ For one thing, they were never vulnerable to the latest round of DNS
           spoofing.
           \_ i think the latest round of dns spoofing attack was overblown.
              yes there was a security hole... but no one ever exploited it.
              and it would have gone away when your cache refreshes from
              the authority.
              \_ Considering the full weakness hasn't been published yet, I
                 wonder how you came to that conclusion?
                 \_ http://www.infoblox.com/solutions/DNS-Security-Flaw.cfm
        \_ OpenDNS is useless because my VPN requires that I get a
           domain error the first try before going to the company's DNS.
           OpenDNS forwards me to a bogus advertising site if my domain
           is bad. You know, I always use 4.2.2.2, Level3. It is trustworthy
           and works. 95% of the admins I know use 4.2.2.2.
2025/04/04 [General] UID:1000 Activity:popular
4/4     

You may also be interested in these entries...
2013/8/22-10/28 [Computer/Companies/Yahoo, Industry/SiliconValley] UID:54732 Activity:nil
8/22    http://marketingland.com/yahoo-1-again-not-there-since-early-08-56585
        Y! is back to #1! Marissa, you are SEXY!!!
        \_ how the heck do you only have 225M uniq vis/month when there
           are over 1 billion internet devices out there?
           \_ You think that every single Internet user goes to Y!?
        \_ Tall blonde skinny pasty, not my type at all -former Y!
	...
2013/6/26-8/13 [Computer/Domains, Computer/Networking, Computer/SW/WWW/Browsers] UID:54697 Activity:nil
6/26    This ones for you psb -ausman
        http://25.media.tumblr.com/027fe67c84c2288cc16e9c85db690834/tumblr_mp0ag8DCQI1qzwozco1_1280.jpg
        \- that's pretty good. i wish someone had put the idea to be before i saw
           it on the internet, so see if i'd have put the 9 justices in the same
           boxes. JOHN PAUL STEVENS >> All the sitting justices. --psb
        \- that's pretty good. i wish someone had put the idea to be before i
	...
2012/8/25-11/7 [Computer/Domains] UID:54464 Activity:nil
8/25    What's the best way to get a domain name that is about to expire?
        \_ It's called backordering.  It used to be fixed priced but now
           they're trying to auction them.  Still a good deal though.
           http://www.pool.com/addBackorders.aspx
           http://www.godaddy.com/domainaddon/domain-backorders.aspx
	...
2012/4/2-6/4 [Computer/SW/Languages/Java, Computer/SW/RevisionControl] UID:54353 Activity:nil
4/02    We use Perforce at work for revision control. It seems to work okay.
        Lately, a lot of the newer developers are saying that Perforce
        sucks and we should switch to Mercurial or Git. I have done some
        searching on the Internet and some others have this opinion. Added
        advantage is that Mercurial and Git are free. However, there would
        be some work to switch for the sysadmins and the developers.
	...
2012/4/26-6/4 [Computer/Networking] UID:54371 Activity:nil
4/26    I see that soda has an ipv6 address but ipv6 traffic from this box
        doesn't actually work (ping6 <DEAD>ipv6.google.com<DEAD>, ping6 http://www.v6.facebook.com
        Is this expected to work?
        \_ Soda doesn't have a real IPv6 address.  The IPv6 addresses you see
           in ifconfig are just link-local addresses; any IPv6-capable machine
           will autogenerate these, whether or not it's connected to an IPv6
	...
2011/11/8-30 [Computer/SW/Security, Computer/SW/OS/Windows] UID:54218 Activity:nil
11/8    ObM$Sucks
        http://technet.microsoft.com/en-us/security/bulletin/ms11-083
        \_ How is this different from the hundreds of other M$ security
           vulnerabilities that people have been finding?
           \_ "The vulnerability could allow remote code execution if an
               attacker sends a continuous flow of specially crafted UDP
	...
Cache (4351 bytes)
www.infoblox.com/solutions/DNS-Security-Flaw.cfm
More information on DNS vulnerability and Frequently asked questions JULY 21 UPDATE: Details Regarding How To Exploit The Vulnerability Have Been Released Into The Wild On July 8th, 2008, the US Computer Emergency Readiness Team (CERT), a joint government-private sector security partnership announced a serious DNS security flaw that makes virtually all DNS servers vulnerable to cache poisoning. The flaw exists in the design of DNS protocol and therefore virtually all vendors and products including ISC BIND and Microsoft DNS servers are affected. This vulnerability has the potential to redirect all of the website traffic to a malicious web page if the cache of a DNS server is poisoned using this method. Cache poisoning attacks are well known and understood but before discovery of this vulnerability it was generally believed that mounting such an attack would require bombarding a DNS server with tremendous amount of traffic and thus could be identified and blocked easily. This vulnerability makes it possible to poison a DNS cache without being detected and therefore poses a serious security risk. The flaw was detected several months ago by Dan Kaminsky (and kept secret) while a group of researchers worked on fixes for all of the affected DNS implementations - which include ISC's BIND and Microsoft's DNS server. UPDATE: A complete explanation of the DNS vulnerability and an explanation of how to create an exploit has been publically released. ALL ORGANIZATIONS ARE URGED TO PATCH THEIR DNS SERVERS IMMEDIATELY. We also encourage you to view the Webinar hosted by Cricket Liu and Dan Kaminsky. US-CERT VU#800113 (CVE-2008-1447) Frequently Asked Questions What is DNS cache poisoning? DNS cache poisoning is a security attack on DNS servers that allows attackers to populate DNS server caches with incorrect information. A client request to a legitimate website can be directed to a malicious website using this attack. Once a non suspecting user connects to the malicious website, they may divulge personal information eg bank account numbers and passwords similar to phishing attacks. Normally, DNS cache poisoning is not easy to exploit and the known methods to poison a DNS cache require sending large amounts of data to DNS servers and therefore easily detected and blocked. However this vulnerability (CERT VU#800113 (CVE-2008-1447)) allows a hacker to poison DNS cache easily and without being detected. Details of this new vulnerability have not been released yet to allow for administrators to patch their servers before the technique becomes well known to attackers. However, an exploit has now been released into the wild. This flaw exists in the design of DNS protocol and therefore all vendor products including those from Microsoft, ISC and Cisco are affected. Will automatic patching using Windows Upgrade resolve this issue? Windows Update can upgrade the DNS client on your PC, DNS servers represent the most significant vulnerability, and few (if any) IT departments will use Windows Update to patch their production DNS servers. Companies using Microsoft DNS will have to patch all of their servers - which can be a significant and disruptive undertaking. All administrators are advised to obtain patches to their DNS servers from respective vendors. If you cannot patch immediately there are some workarounds that can limit exposure: Limit access to recursion as much as possible Only allow recursive queries from internal clients Of course, if you are performing queries to outside servers, the response can be spoofed. The only way to protect servers that must process recursive queries to outside servers is to patch those servers, which may be a significant undertaking. The Infoblox DNS solution is based on BIND and therefore older versions of software contain the vulnerability. Infoblox works closely with Internet Software Consortium (ISC) and has already released software that includes fixes for the vulnerability, including UDP source port randomization. The patched releases are available to all supported Infoblox customers via the Infoblox Support Web site. Upgrading to the new software is relatively simple using the automated upgrade features provided by Infoblox grid technology - and for customers with best practices architectures deployed, upgrades can be achieved with no service downtime.