めっちゃ珍しいカノニカル・ネイム

Article View: fj.net.ip.dns

Article #5

From: Shibuya, Nobuhiro
Date: Fri, 25 Jul 2008 14:14

25 lines
2116 bytes

http://www.jpcert.or.jp/at/2008/at080014.txt
に注意喚起が出ています。

小島さんのセキュリティホール・メモ mailing listで知った
めっちゃ珍しいカノニカル・ネイム

http://isc.sans.org/diary.html?storyid=4765
の真似を手元のWindows XP HomeのPCで試みたところ:

> set type=txt
> set timeout_30
> porttest.dns-oarc.net.
Server:  xxx.xxx.xxx.xxx
Address:  xxx.xxx.xxx.xxx

Non-authoritative answer:
porttest.dns-oarc.net   canonical name = z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net     text =
        "210.138.175.22 is GOOD: 26 queries in 2.9 seconds from 26 ports with std dev 16291.82"
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net     nameserver = ns.z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net
>

というわけで、キャッシュ・ポイズニングにご注意召され。
-- 
mailto:shibuya@dd.iij4u.or.jp           渋谷伸浩

Technical Details

Message-ID: <4889DFDC.28A49CBE@dd.iij4u.or.jp>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!newsfeed.freenet.de!news.unit0.net!news.open-news.com!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: 110989,7cbb95d4f4c310a5,start
X-Google-Thread: f5529,7cbb95d4f4c310a5,start
X-Google-Thread: 1024ce,7cbb95d4f4c310a5,start
X-Google-Attributes: gid110989,gidf5529,gid1024ce,domainid0,public,usenet
X-Google-Language: Japanese,JIS
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!newsfeed.freenet.de!news.unit0.net!news.open-news.com!not-for-mail
From: "Shibuya, Nobuhiro" <shibuya@dd.iij4u.or.jp>
Newsgroups: fj.net.ip.dns,fj.comp.security,fj.net.watch
Subject: めっちゃ珍しいカノニカル・ネイム
Date: Fri, 25 Jul 2008 23:14:52 +0900
Organization: a person
Lines: 25
Message-ID: <4889DFDC.28A49CBE@dd.iij4u.or.jp>
NNTP-Posting-Host: 244.21.30.125.dy.iij4u.or.jp
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
X-Trace: open-news.com 1216995300 95496 125.30.21.244 (25 Jul 2008 14:15:00 GMT)
X-Complaints-To: abuse@open-news.com
NNTP-Posting-Date: Fri, 25 Jul 2008 14:15:00 +0000 (UTC)
X-Mailer: Mozilla 4.8 [en] (Windows NT 5.0; U)
X-Accept-Language: en