Comments on: debian.org domainsquatted ? (1)

By: cstamas

cstamas — Fri, 13 Jun 2008 06:12:04 +0000

lol

By: Obey Arthur Liu

Obey Arthur Liu — Thu, 12 Jun 2008 23:00:14 +0000

To Jonathan Roes:
Hopefully the new netconf will realize that I’m not at home and drop the .home.eu suffix search

By: Jonathan Roes

Jonathan Roes — Thu, 12 Jun 2008 22:53:15 +0000

Seriously? What do I have to do with any of this?

By: Jean

Jean — Thu, 12 Jun 2008 12:03:32 +0000

Offtopic:

so you come down to Grenoble? Drop me a mail so we can have a beer at the O’Callaghan (or wherever) someday, or if you ever want to go climbing (you have access to the private ‘e-mail’ field of this post, right?)

Offtopic bis: Do you intend to check out the Hacker Space Fest near Paris next week? http://www.hackerspace.net/

By: Riku Voipio

Riku Voipio — Thu, 12 Jun 2008 08:18:16 +0000

For some reason the lookup for debian.org fails, so the resolver falls back to trying “debian.org.home.eu”. This is because the default “search” rule for resolv.conf(5) is to pick up the domain part of hostname, which is “aeris.home.eu”.

By: cstamas

cstamas — Thu, 12 Jun 2008 05:40:42 +0000

See this:

% dnsqr any debian.org.aeris.home.eu
255 debian.org.aeris.home.eu:
138 bytes, 1+1+2+2 records, response, noerror
query: 255 debian.org.aeris.home.eu
answer: debian.org.aeris.home.eu 3591 A 216.8.177.23
authority: home.eu 19963 NS ns2.fastpark.net
authority: home.eu 19963 NS ns1.fastpark.net
additional: ns1.fastpark.net 125233 A 206.130.11.197
additional: ns2.fastpark.net 125233 A 216.8.177.29

remove the “search” statements from you resolv.conf

By: Obey Arthur Liu

Obey Arthur Liu — Wed, 11 Jun 2008 22:17:17 +0000

to toupeira:
That’s right but there’s no explanation yet of how it factors in.

By: toupeira

toupeira — Wed, 11 Jun 2008 22:12:42 +0000

home.eu and every subdomain below that resolves to 216.8.177.23, with NS records pointing to fastpark.net. the TTL seems to count down every second. connecting to that IP with the host header set to “www.debian.org” gives that page you found.

Hmm… I still don’t get it

By: Obey Arthur Liu

Obey Arthur Liu — Wed, 11 Jun 2008 21:07:16 +0000

to aeth:
Can’t be, the whole path from my computer to the gateway on a dedicated server is under my control and encrypted.

to Marius Gedminas:
The result on my laptop was 216.8.177.23 and of course it stayed due to caching. Now how did that happen ? There was no attack involved.

By: Marius Gedminas

Marius Gedminas — Wed, 11 Jun 2008 20:27:58 +0000

DNS cache poisoning?

No idea, but it would be interesting to see what http://www.debian.org resolves to when you see this. The real one is 194.109.137.218.