North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Vixie doing his part to make people upgrade (was:Re: Reasons why BIND isn't being upgraded)

  • From: Jared Mauch
  • Date: Sat Feb 03 03:58:17 2001 
On Sat, Feb 03, 2001 at 12:35:32AM -0800, [email protected] wrote:
> 
> 
> On Fri, 2 Feb 2001, Patrick Greenwell wrote:
> 
> > 
> > P.S. AboveNet is taking the latest BIND vunerability(ies) seriously enough
> > that they are beginning wholescale scans of their address space. Draw your
> > own conclusions related to masking version numbers.
> > 
> The bulk of that announcement from Above.net is from 2 lines:
> > We will be checking every IP in our space on port 53 in order to find
> > versions of BIND open to a root exploit. 
> 
> I'm not sure my agreement with Above.net allows them to scan my network,
> though it is admittedly their IP space.  I'll go check the paperwork on
> Monday.  (Honestly I expect to find it does, though I must have been
> smoking something when I signed it.  Above.net is usually on stable legal
> ground.)
> 
> That aside, I am concerned that the announcement makes no mention of who
> they would disclose this information to.  Presumably the registered
> contacts for the offending customer, but above.net has not said they'll
> tell anyone.  
> 
> Needless to say, I am not happy with this.  I can't imagine anyone would
> be happy with their provider scanning their network.
> 
> (Also leaving aside the fact that this scan will be pretty much
> useless, given cases where named is run as a different user, chroot'd,
> instructed to lie about its version number, etc.)


	most providers can nullroute ip space due to AUP violations.

	This includes open relays and other "security" risks.

	I'd not want to be abovenet security team responding to queries
about why all my customers had rooted machines and were attacking 
<big-e-business-name-here>.

	- jared

-- 
Jared Mauch  | pgp key available via finger from [email protected]
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.
END OF LINE  | Manager of IP networks built within my own home