Slashdot Mirror
W2K and MAC OS9 Flood Root Nameservers?
wizzy writes "Irelands toplevel domain registry has a notice on Microsoft and Apple DHCP clients sending dynamic DNS updates per RFC2136. The problem is they are not sufficiently careful about where they send it if they are in RFC1918 space - usually used for behind-firewall addressing, which is where they usually are.. This is resulting in bogus updates being sent at the rate of nearly one million an hour to root nameservers, only to be rejected - as reported on the NANOG mailing list."
With Photoshop 7 out and this, now Mac OS9 users have an even better reason to upgrade to OS X - "to save the Internet." :)
"The objective of securing the safety of Americans from crime and terror has been achieved." -- John Ashcroft
Yet another reason to use firewalls to filter _OUTGOING_ connections and not only incoming ones (the other reason : to avoid backdoors) .
{{.sig}}
This reeks of something that should've been caught in user testing. Unless, of course, Microsoft and Apple decided that they didn't care about the operators of the root nameservers.
just another reason to start using mac os X... or lets start educating people, i wonder how much resources those bad-changes make anyways....
Kaoslord [quote goes here] define("slashdot purity","67.5");
Christ! Which link is the real story?
Prevent email address forgery. Publish SPF records for y
Before everyone jumps down MS's throat (or Apple's) does anyone know how to reconfigure a system to fix this issue?
3000 dead over past 2 years, still no free Palestinians, still
Their name servers are under the "IE" domain...
.ie = Ireland
I pledge allegiance to the flag...
of the Corporate States of America...
I know these problems. In my small ISP company, we ar running our own nameserver.
The logs are flooded from rejected name server updates (several hundreds a day).
They are mostly coming from misconfigured W2K servers from our customers, running their intranet with DHCP and using the same domain as in the real net.
Sadly, we contacted the administrator, but he didn't have a clue what I was talking about (they're justig running windows on their server because they know windows...)
Usually I would suggest to use an internal domain name that doesn't exist in the internet and just "masquerade" the mail domains. So resolving internal addresses from extern fails if some information slips out and the internal servers won't resolve some external name server to contact when an internal server should be.
They only solve a SYMPTOM of the issue. These people need to set their systems up correctly! Either a) install MS-DNS and point your boxen at that, or b) use BIND, but ENABLE dyn-dns and stop this traffic at the local level. ;)
And if you use a RFC1918 address space, your DNS server should have reverse lookups enabled for that address space - even a split zone so the world won't see them - and that will a) help management of the network easier, and b) prevent problems like this from happening
The root nameserver's initially thought that they'd been linked to by /. daily, but then realized that nobody cared about them :)
Another problem is that people are naming their boxes after popular domains
that they don't own, and the dynamic updates are pounding the hell out of the
domain owners nameservers. If anyone here is doing this, owl.com and jove.com
were two of the domains named.
Sealbeater
-- Its survival of the fittest...and we got the fucking guns!!!
I thought this sounds more like a case of misconfiguration than a bad server itself.
Also, assuming that people are DHCP'ing on a local 192.168.* address space, shouldn't upstream routers (especially those on cable companies and the like) automatically filter out any packets with local addressing as opposed to forwarding them?
Infact you'd think they'd filter out ANY DHCP information coming from their subscribers as opposed to sending it out publically?
"Nothing strengthens authority so much as silence." - Charles de Gaulle
There are a couple thousand Windows machines of various flavors inside my network and they are constantly generating crap lookups. I see my poor machines forwarding them to the outside, no doubt pissing someone off.
Where 'FOO' is one of our servers:
FOO.k12.co.us
FOO.co.us
FOO.us
FOO (this is what hits the root servers)
These things are trying to do DNS even when WINS would have a perfectly good answer. Multiply this by thousands of lemming systems and you have a bunch of load that should never be there.
I wonder if adding NS records for the bogous in-addr.arpa domains would help, i.e.:
168.192.in-addr.arpa NS 192.168.1.1
10.in-addr.arpa NS 10.0.0.1
...
Claus
A Microsoft spokesman said, "Thing is, is that those root nameservers would all be fine if they were running Win2K DNS services. " :)
Get your own free personal location tracker
Specifically, if your WinXP advanced DNS settings look like this, then just uncheck that box.
I wonder who copied whose code?
why is this the first time that anyone's noticed this?
You think that just because you read this article on Slashdot today that it was "just noticed" as of yesterday or something?
Gee, thanks a lot.
So you get what you pay for. You drive down the perceived value of a Microsoft sys admin and you fill these positions with poorly trained or MCSE certified test takers with no real grasp of the larger issues involving administer *any* IT site.
Any competent sys admin would ensure crap like this doesn't happen, no matter what the OS is.
And if the gap in pay and value between Unix and Windows sys admins is widened, who in their right mind coming out of a CS degree in college (not some fly-by-night certification course) is going to want to use their training to specialize in the market that pays the least?
Hasn't MS had this around for a while now?
They even called it MS-DOS...oh wait, that was Disk Operating System...nevermind.
putting this under the microsoft headline, i mean, i know you don't like them, but it's hardly fair to them, apple is doing it too! hatred is only successful if you annihalate them without being partisan.....
--fetch daddy's blue fright wig, i must be handsome when i release my rage
Here's the solution:
1. Upgrade to Mac OS X. It's so cool.
2. People use W2k on the internet? Is that safe???
If the problem is the private IP's attempting to update DNS records then they have to have been nat'd or masqueraded in someway, so short of parsing EVERY DNS packet there is no way to tell since the source address will the user's public IP
Actually this does not sound at all like an issue that should've been caught in user testing. There is no magic to software testing, and it's a thoughtless misconception to think that "good" software testers will catch every conceivable issue. Software testing catches what the software testers are looking for. Any other issues have to be fairly obvious to be caught, in most cases.
You know, I never understood why they did this as default. And I am also surprised it took this long for anyone to loudly complain. First thing I have always done when installing 2k/xp machines that don't need it is uncheck that option.
MS clients should not attempt this unless they are on a 2k AD domain. This is also as someone pointed out a good reason to filter your outgoing traffic.
It reminds me of when they had that check for "logon" enabled by default for ppp connections, when 90% of ISP's didn't support this.
If you wanna get rich, you know that payback is a bitch
Look out, I think this is an MS plot
First flood the root servers (running bind), cause them to fail, and then claim that if they ran MS-DNS, this wouldn't be happening.
To quote from RFC1918:
It is strongly recommended that routers which connect enterprises to external networks are set up with appropriate packet and routing filters at both ends of the link in order to prevent packet and routing information leakage. An enterprise should also filter any private networks from inbound routing information in order to protect itself from ambiguous routing situations which can occur if routes to the private address space point outside the enterprise.
If you are connecting your internal LAN using a private address space (10/8, 172.16/12, or 192.168/16) you are obviously using a firewall or router configured with NAT.
These need to be configured correctly for many different reasons, including the prevention of the effect mentioned in this article... Add null routes, or packet filter rules for any outgoing packets containing a destination falling in the RFC1918 address space. Also do the same for the incoming packets. By not doing this, you are flooding your upstream provider (in this case the root DNSs) with tons of bogus *(^@.
A few years ago I was lead engineer for a wireless internet company. Our clients were provided with a raw connection, just as if they had gotten a T1. After doing a week long network audit shortly after starting there, I was amazed to find that over 80% of our customer base had internal configuration problems with their NAT setups. Sniffing on the network, I got to see everything from MS Browse messages, DHCP requests, Netware "burbs", and tons of other stuff that should have never left their LANs.
I finally ended up installing firewalls at each POP site, just to dump out the extra junk... Our network speed increased by over 20% just blocking this nonsense at the POP (tower site) and keeping it from coming over our wireless backbone connections... On a typical 16MB/s link that's over 3MB/s of bandwidth we saved.
It appears Ockham lost his razor and grew a beard.
Using a private "unroutable" IP address affords surprisingly little protection. Using techniques like source routing or a compromise of a trusted host, your network can be quickly and easily penetrated.
Firewalls are needed even if you are using private addresses and NAT to access the Internet. In fact, the main reason to use NAT for a local LAN is so that your LAN IP addresses don't conflict with public addresses!
You have to use NAT with these private addresses, or else external connectivity doesn't work. (without a public address, it's damn near impossible to determine how to get the packets back to you!) And that means some things (for example, many network games) either don't work or work in only limited fashion.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Actually, you probably are. Win2k sends the DNS updates anyway even if it's got a static IP. If the DNS server rejects it it waits a couple of minutes and sends it again... seemingly forever.
Win2k server also tries to send to a bogus 172.16 address even if it's been assigned a static IP which isn't in this range - there seems no reason for this, it's just being odd. You have to make sure your firewall blocks that too otherwise you're just passing private IP addresses to the upstream router (which will either dump them or pass them even higher).
If you want a bit of fun run tcpdump on an idle Win2k machine & watch how many packets it sends... you'll be surprised.
Who do you want to flood today?
This problem, among with many, many others, was described in a CAIDA paper, "DNS Measurements at a Root Server." They basically ran TCPDump on root server F, and analyzed the traffic. An amazing number of invalid requests are sent all the time. It really shows how important it is for network admins to correctly set up their name services, but it also identifies problems caused by bugs in software. Very interesting read: http://www.caida.org/outreach/papers/2001/DNSMeasR oot/
I'm not trying to be smart, but this proves my point. Do you really think it's wise to throw an entry-level microsoft admin into a role administering microsoft servers?
Sure, you may be able to install a w2k server and pick all the defaults for active directory and basically have it work, but an experienced admin understands not only the technical requirements of something like Active Directory, but the huge human issues surrounding it, like the need to push an organization to define its structure so as to better define a workable active directory structure that does a little more than just spit out random DHCP replies, answer DNS requests, and authenticate a few logons...
It doesn't matter if you bow before the great Unix or Microsoft God, you should have experienced as well as entry-level tech positions in an organization. Having a policy that excludes either set is short-sighted and foolish.
CmdrTaco, this news article has six links, but
only of them actually relates directly to this
particular piece of news. Please make it
more obvious which one is correct -- I'm tired
of having to move the mouse over each one and
see what the address is in order to try to figure
out which link actually gives me the news.
(please mod this up so people see it! this is
becoming a big problem on slashdot. and this is
anonymous, so it's not karma whoring)
What exactly is your complaint about firewalls?
....because they are hard to configure?
Do you think that firewalls are a bad thing?
>The only purpose of firewalls seems to be to accomodate people who can't be bothered switching to DHCP.
Is this a joke?
lunky> c++; lunky> do{;}
How often does Win2K register these ip addresses? Is it once an hour or so, or is there really a million win2k boxes being rebooted every hour?
Of course, ISPs should be filtering out packets in RFC1918 space, and their DNSs should be managing the requests rather than bugging the root servers with them.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Mac or Macintosh is for Apple Macintosh computers.
When people say "MAC" I think networking. When people say "Mac" I think Macintosh.
CAn'T CompreHend SARcaSm?
Nope. I'm unix and windows person only, sorry. All I know is my friend's G4 powerbook has a cool taskbar thing.
This isn't a security hole. In fact, it's more of a feature.
Hmmmm... DDNS updates could be considered to be a feature. What is definately NOT a useful feature is that they are enabled by default.
Why on earth would/should it ship differently?
Isn't that the point of the article? The fact that this feature is on by default is causing the root name servers to be flooded with 1 MILLION DDNS updates per hour. That means very simply that Microsoft's latest misplaced attempt to be featureful is resulting in what is effectively a DDOS against the root nameservers. That is a very bad thing.
Not to be making ms look better, but to give some people a way to fix it. http://support.microsoft.com/default.aspx?scid=kb; en-us;Q259922
The spirit of resistance to government is so valuable on certain occasions that I wish it to be always kept alive
The canned meat is "SPAM".
The theft of resources is "spam".
18-Apr-2002 16:16:05.491 security: notice: denied update from [63.198.141.30].2323 for "168.192.in-addr.arpa" IN
by "a whole lot" i mean we've logged 3.3M of these in the last four hours..."
t_t_b
I'm on PJ's "enemies" list! Are you?
Part of the reason for being so restrictive (or so we were told): every service they allowed to pass over the firewire added to the cost of maintaining the thing.
Come to think of it, they probably shouldn't allow TELNET.
Perhaps my rant against them reflects my relative ignorance of routing issues. My current employer employs a proxyless system that allows me to see out of the network, but not others to see in. Is that a firewall? Given the vagueness of the concept ("Some of the best firewall professionals I know don't even bother with firewalls" -- Chapter 12 of Secrets and Lies), it probably depends on who you ask.
No self respecting OS has source routing enabled. Yes, Windows does, but that was my point.
'Trusted Host' implies that in your infininte wisdom you have trusted it. If it gets compromized, well, you know the deal.
I've seen several firewalls with security so tight a single stray packet will cause an alarm to go off. However, equal though is not give to physical security as you can just walk in and stick a disc into the nearest machine. Just a point to ponder for sys admins out there.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
What is it with people and writing MAC instead of Mac?
Mac is short for Macintosh, it's not a bleeding acronym! I can put up with it when it comes to ignorant posters, but seriously, shouldn't the Slashdot editors know better?
is here.
/not/ funny seeing a ten megabyte logfile produced every seven minutes. I wonder what they use for logfile analyses, I think it's getting more information than it's able to process.
It's funny to see a ten megabyte logfile produced every seven minutes *SLAP* woops. It's
Edwin
bash$
Blockpoth the quoster:
No. (Although using ".localdomain" doesn't suck as badly as naming your private network "slashdot.org" and assuming that your NATbox will prevent anyone from seeing this posturing..) In practice, using ".localdomain" probably won't break anything as a pseudo-TLD for an RFC 1918-conformant private IP space, presuming you're talking about a home network that's not going to have anything complex depending on absolutely strict, standards-compliant DNS behavior, but it's actually defined as a domain "having an A record pointing to the loop back IP address and is reserved for such use. Any other use would conflict with widely deployed code which assumes this use." I.e. for DNS purposes, the only .in-addr.arpa domain that should map into localdomain is 127.in-addr.arpa -- this is the class-A netblock for your loopback interface(s), which all have the form 127.#.#.#.
RFC 2606, "Reserved Top Level DNS Names", says that the TLD for a private network space should be one of the following:
- .example
- .test
- .invalid
(Note: there's no (technical) reason the TLD has to have three letters or less.)Need a UNIX/Linux/network guru in the Boulde
"With enough eyes, all bugs are shallow" or something to that effect.
It's the find and identify. A lot of bugs stay very well hidden until you look at them in just the right way.
I am an administrator for some IP space assigned but not ever routed. Several years ago, I was wondering where the hell all my bandwidth was going and found a lot of it was for DNS traffic trying to resolve IPs in that space. This was very odd, considering that it wasn't routed. These were at the rate of about 10 per second per IP address, and there were about 80 addresses two servers were querying for, for a total of 1600 requests per second. Now, there was no DNS server running on the host that these requests were going to so they were send port unreachable messages.
:)
Evidently what was going on was this large corporation was using MY IP space internally, but they weren't making their DNS servers authoritative for it, so the DNS servers went to the Internet (and to me) for resolution. Something somewhere was configured wrong and so they retried constantly.
I firewalled these DNS servers out, but not before I composed email to the whois contact at the big corporation telling them to fix this stuff. They ignored me (yes I made sure their SMTP sending host was not blocked). Firewalling didn't fix the problem, only kept my server from sending port unreachable messages. The queries from the big stupid corporation's network were only getting worse. I was getting really pissed off.
So I put up a DNS server up on that host, and made entries for every single IP (I was using bind, which is too stupid to have default responses). And I had fun, with obscene and abusive DNS names for every host, and forward resolution to match (in a silly domain also routed to the same dns server) -- and the highest possible TTL! Problem solved!
The funny thing is that this staid corporation was now seeing all sorts of nasty names on their internal servers...BAH HA HA.
The abuse stopped. Hopefully, someone was fired. Now we know that they will never attack me again in this way: you see, that abusive network belonged to Enron
I actually let them off the hook easily. I had, at this point, control over data being returned to servers well firewalled away. Servers that probably had ancient resolvers that had buffer overflows in their DNS resolvers. High level servers that could have been r00ted straight through the firewall.
moral of the story: don't leave dns work to weenies. You may be surprised at the results.
We (uconn.edu) detected this either last year or the year before with misconfigured windows clients (typically win2k AS where someone left the DNS service running with a default configuration).
Seems like security is a perimeter type of thing. Weakest link and all that.
As long as people inside get email and have access to web pages and floppy disks, there is nothing a firewall can do that will actually make the network secure. A hair-trigger firewall seems like a good target for diversionary attacks.
Just remember .NET
These are the folks bringing you
We both got all beef patties, special sauce, lettuce, cheese, pickles, and onions. But, they use a sesame seed bun. My buns have no seeds.
What does dumb fuck mean?
CAn'T CompreHend SARcaSm?
Um, you dont uncheck the "Let Windows manage my virtual memory" box.
DNS is not specialised knowledge. Neither is swap (thats virtual to you) memory. I hope you can still get a job with that MCSE you bought.
Idiot.
I said how it works, not what settings you get to play with.
And DNS is specialized knowledge. Just because someone has an MCSD, doesn't mean they know how DHCP, DNS, BOOTP or RARP work. Typically, they don't need that knowledge.
Similarly, just because someone is a sysadmin and understands how these protocols work, it doesn't mean that they know the first thing about software development, software engineering or software architecture.
Most sysadmins, for example, wouldn't know what the difference between a single-threaded apartment and a free-threaded apartment was. Or what the first window message a dialog box receives. Or, for example, how to program in Sather. Or Cobol. Or Z80 assembly language.
Get the picture? Knowledge is specialized. Just because an "MCSE" or an "MCSD" doesn't know something, that doesn't mean it's wrong. You don't see an internal medicine specialist about your acne - and you don't see a software engineer about how to configure your network. Although, most likely, typically, both will know a little about the other field.
In other words, don't make fun of people's lack of knowledge until you know they're unwilling to learn about anything. Because they may know more than you will ever dream of knowing about some other field.
Simon
Coming soon - pyrogyra
Just got finished setting my 2K box straight. Yeah, I think that ICANN should think quite strongly of setting aside .LAN as a non-routable TLD. Simple, looks like a real TLD, but can't get out on the Internet. Just like non-routable IP addresses: 10.x.x.x, 192.168.x.x and those Class B's that nobody uses but are there anyway.
.LINK as a non-routable TLD, but .LOCAL was once proposed and is often used as an example in books about TCP/IP networking. .LAN, however, has the advantage of looking like a "proper" TLD. (at least Stateside, anyway...)
I didn't know about the attempt to codify
Knowledge is power. Knowledge shared is power multiplied.
Radio Shack also licensed OS9, and used it as the operating system for the Color Computer.
Knowledge is power. Knowledge shared is power multiplied.