Slashdot Mirror
Some DNS Requests Ruled Illegal in North Dakota
jgreco writes "A judge in North Dakota has just ruled that requesting a zone transfer from a public DNS server is criminal activity within the meaning of the North Dakota Computer Crimes Law. A zone transfer is a simple request that a DNS server hand over information in bulk, and a DNS server may be configured to allow or deny such requests. That the owner of a DNS server would configure the server to allow such requests, and then claim such requests were unauthorized, is simply stunning."
Might want to read the actual court ruling instead of the populistic and alarmist comments surrounding it. As I read it, the defendant already had been told by the court to stop bothering the plaintiff, and he then proceeded to ignore that. In and of itself the ruling doesn't outlaw dns requests, altough the judge's grasp of the technology clearly could stand improvement.
BIND 9.x and earlier allow this activity by default. This being the case, a new and/or ignorant system administrator may not realize their zone file is available for the taking.
One more example of the law having to protect the stupid, but I can *sorta* see the point of it. This falls in line with stealing wifi from unprotected networks. Just because it's not secured doesn't mean it OK to break in.
It's a civil case.
The worst that can be said about it is that it's bad precedent and the judgment was wrong.
The judge did not make DNS requests illegal.
If Ritz had previously been ordered to leave Sierra alone, and hadn't, then that's a basis for the ruling right there, completely ignoring any aspect of DNS. From the court documents, the guy sounds like quite a piehole.
It says (even in the summary) we're talking about zone transfers, not regular lookups. So sue all you want, just don't be surprised when every case is thrown out.
The act of putting up a DNS server is exactly the same. But we now know it's illegal to access a DNS server, therefore it must be illegal to access a web server.
Without written permission in triplicate, signed in longhand by the owner of the data using a quill pen and attested by the county registrar and the sheriff, of course.
I'm old enough to remember when discussions on Slashdot were well informed.
FINDINGS OF FACT
"In all intended uses of a zone transfer, the secondary server is operated by the same party that operates the primary server. A secondary intended purpose for zone transfers is to permit trouble shooting in which case zone transfers may sometimes be undertaken via the manually conducted host -l command. In those instances, however, the person conducting the diagnosis acts with the authorization of the operator of the system and is usually the network administrator for the system."
Sounds like the judge understood it pretty well to me.
Intron: the portion of DNA which expresses nothing useful.
That's what Sierra did, according to the court decision.
Either the admin responsible is incredibly stupid, incredibly lazy or just hasn't thought through the security implications.
One swallow does not a fellatrix make
No, it's not completely ridiculous. We can talk about generalities as long as we want but they are nothing but straw men. This is a specific case, and it appears to be a special case, where the defendant had an injunction against him to prevent him from harassing the company in question.
Essentially, the judge ruled that the injunction did indeed include the DNS servers the company had. Imagine that, he got that one right!
IOW, even if the company was running a web server on port 80 and require no authentication, it can easily be assumed that --- the defendant would still be barred from making requests to that page. No, not people in general one specific individual who was barred from interacting with the company.
To rule otherwise is nothing but pure stupidity.
but there is NOTHING ILLEGAL mentioned here. This is a civil trial, not criminal. The acts may be found illegal later in Ritz's later criminal trial, but that remains to be seen. Also, the issue is a question of whether Ritz was authorized to do the DNS request. The DNS request is legal for the administrators without problem. Obviously, the issue of Ritz's requests is worth debating. The article summary is horrible, as is the linked article. But, the linked blog entry has yet another link which gives the whole opinion as well as some more informed commentary. For those that want to be informed before spewing, I would suggest checking it out. (for the the other 99% of slashdotters, please feel free to ignore this at will).
There's actually a good deal of information in there if you read between the lines a little. What I gathered from it and one of the sites linked by it, is that this guy is well known in the anti-spammer circles as a spam investigator that can compile loads of detailed info on spammers. Apparently Sierra (the plaintiff) is notorious for spam and also for suing anti-spam activists. During the course of compiling evidence against Sierra, this guy performed a DNS Zone transfer (most likely to prove that the source of some spam was actually a server hosted by Sierra). Sierra then sued him claiming the zone transfer wasn't authorized by them, and therefore it was illegal (not going to argue if that's logical or not, just summarizing here). Up to this point any technically minded person would probably think the plaintiff was on pretty shaky ground. However, the defendant screwed himself over it seems by annoying the judge various ways. According to the findings, the defendant gave false testimony on several occasions. It may or may not have been false testimony, it's sometimes hard to say when lawyers get involved, but the judge perceived it as such and that's what counts. Much worse it seems, is that the judge ordered the defendant not to perform certain scans of Sierras network, but he then proceeded to ignore those orders. This action seems to be the one that really blew the case for him, as it's apparent the judge was really not happy with him for that one.
Curiosity was framed, Ignorance killed the cat.
I'm guessing you're young, under thirty at least. I only say this because the "the tag may only be removed by the consumer" bit is a change that was made about fifteen years ago, before that they read "Do Not Remove Under Penalty of Law" in bold, black letters. So most people grew up with these ominous tags on all their pillows and mattresses warning that if they removed them there were stiff penalties involved. Nowadays, not so much. Meh.
So who's the nerd now, huh?
I stole this sig from a more creative user.
As one of the people involved in this, I think I should take a minute to set the record straight.
Sexzilla was once one of the largest porn spammers on usenet. I wrote about them on my web site. The owner, Jerry Reynolds, sued me for defamation. I asked the other spam-fighters for whatever they had on Sexzilla so I could defend myself.
David Ritz responded with something along the lines of "Oh, it's true alright, here's the dns zone information that proves it." He also published his results on-line.
Reynolds then sued David for an "unauthorized zone transfer".
That zone transfer is the entirety of Reynolds' case against David. The rest of the stuff in the judge's decision was all a bunch of bullshit spoon-fed to the judge by Reynolds. Most of it has nothing to do with the case at hand, and most of it is either untrue or gross distortions of the truth. For example, the "hijacked" computer was an open relay that Ritz used to send one message to Verizon security, proving to them that they had an open relay.
You can read the whole sorry saga here.