Centroid.EU Blog(this blog is mostly encrypted - adults only)
November 7th, 2009
This attack theorizes on an attack on caching recursing nameservers. Pretend
someone runs wildcarddnsd and thus wildcards the entire spectrum of their
These are all valid A replies if domain.com has an A record set. Only problem
is that when someone uses up the entire 255 characters of a valid domain
name then the other recursing nameserver theoretically stores all this in
memory for at least the time to live. So if someone looks up:
abcdef...a.domain.com (255 characters)
defghi...b.domain.com (255 characters)
.. then there is an awful lot that is stored in RAM on a nameserver.
If a botnet looks up these long domain names they can cause economic damage
by wasting many many many bytes on an aggregate of foreign nameservers. And
the nameserver that does wildcardding will get the bandwidth bill for all those
lookups, although there is many "root servers" that have unlimited bandwidth
for 60 euros a month. It'll look like a DOS but it's not (yet it can lead to
To save the Internet some pain I've implemented the -W flag on my wildcarddnsd's and to basically save my ass the bandwidth charges.
Something to read that put me up to the idea:
PS: you don't need a botnet to do some damage. If you have a link that allows
spoofing you can spoof into networks that don't have ingress spoofing filters
on their routers and fake a question to DNS servers that would otherwise refuse
to answer you. With the amount of bandwidth one can get 50/10 Mbps a
considerable amount of damage can be done. So the protection against this is
to have solid networks out there that don't allow spoofing of any kind.
November 6th, 2009
This week I purchased and installed 3 things. One, Windows 7 Home Premium
edition. Two, VMware Workstation 7 and finally F-Secure 2010 Anti-Virus.
I've never had an anti-virus program before so this was a first install for
I also downloaded Kubuntu 9.10 and installed it as my VMware host operating
system. That was necessary because my old Redhat lacked some libraries that
I needed for good sound support with the VMware Workstation.
So I had to move some OS's out of my active host team that I keep in the
on state in VMware, in order to accomodate the 1 GB footprint of Windows 7.
Windows 7 was a pain to install because vmware has crappy dvd support and
using a sparse file for the dvd didn't work due to some copyright protection.
When I install Windows I compartment a superuser and a regular user. This
way if there is a virus when I use windows, it can't write over system files
and install a root-kit or whatever. I usually name the superuser admin.
Only when installing Windows it asks to install a user and I didn't name it
admin but "pjp" my usual acronym. So when I learned that I wanted to install
"pjp" as a user with less privileges I had to rename the admin account. It
left the home directory as "pjp" and gave my pjp user the directory of "pjp_2".
Activating the one year subscription for the anti-virus was pretty easy and
I hope everything is protected now. I set it so that it scans files that I
download through the web (real-time).
These were just some experiences I had with this years upgrade, I probably
won't upgrade for at least another year unless something blows up badly.
November 6th, 2009
This weeks hackepedia article is Multicast. Enjoy.
November 3rd, 2009
I fixed a bug in wildcarddnsd that caused zones to be 'lost'. Everyone who
uses wildcarddnsd should upgrade to the latest version or tag "BETA_3".
CVS log there is more detail on what went in since BETA_2.
November 2nd, 2009
44 xearth -pos "fixed 49 0" -sunpos "-15 0" -noroot -nostars -grid -markerf
rosalind$ more markerfile
50.05 10.23 "pbug"
October 27th, 2009
Hackepedia is back online after about
a month of downtime.
October 25th, 2009
Someone asked if round-robin'ing was possible in wildcarddnsd. The feature
was there once so there was still stub-code but it didn't work. I cleaned
that up today and it seems to work. It makes wildcarddnsd a bit slower
because the zones have to be written after every lookup, but otherwise
NS, A and AAAA records do a wildcard round-robin now.
It's not in the repo HEAD yet but if you check out the ROUNDROBIN branch
the code is added on to BETA_2.
October 25th, 2009
Theo de Raadt added my name to the list of people who do donations on their
donations page. The list is quite large by now, and I always wondered why
I wasn't added before. It turns out that if your donations accumulate to a
certain amount (100 dollars CA or so) they put your name on the list. This
is nice, it's a nice self-endorsement and it shows my passion for OpenBSD.
October 19th, 2009
OpenBSD 4.6 was released
yesterday. I'm gonna have fun with this.
I just made a 15 euro bank donation to OpenBSD (which is 23 canadian dollars).
I'm doing this in lieu of buying the CD's, but I'm looking forward to perhaps
getting 4.8 on CD next year.
Click here for RSS
On this day in
By clicking on the header of an article you will be
served a cookie. If you do not agree to this do not
click on the header. Thanks!
Using a text-based webbrowser?
... such as lynx? Welcome back it's working again for the time being.
Older Blog Entries
Powered by BCHS