- techsec-wg - mailman.ripe.net

Announcement DNS for LIRs Training Courses
by Rumy Kanis 21 May '07

21 May '07

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Friday 3 August 2007 Time: 09:00-17:00 Location: St.Petersburg, Russian Federation And Date: Friday 7 September 2007 Time: 09:00-17:00 Location: Nottingham, United Kingdom And Date: Friday 14 September 2007 Time: 09:00-17:00 Location: Amsterdam, Netherlands And Date: Wednesday 20 February 2008 Time: 09:00-17:00 Location: Vienna, Austria Hosted by: Nic.at: http://www.nic.at/ The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

Re: [dns-wg] What about the last mile, was: getting DNSSEC deployed
by Yuri Demchenko 19 Feb '07

19 Feb '07

I think this will not be too much off-topic. What does DNSSEC and Techsec-WG people think about recently revealed pharming attack technique that is based on the end user DNS altering? NEW ATTACK TECHNIQUE THREATENS BROADBAND USERS Millions of high-speed Internet users across the globe are threatened by a new attack technique called drive-by pharming, Symantec and Indiana University researchers warned Thursday. http://go.techtarget.com/r/1004039/1401570 On the practical note, I need to say something definite to my students what DNS experts think? Thanks. Yuri Roy Arends wrote: > Lutz Donnerhacke wrote on 02/16/2007 10:20:09 AM: > >> * Roy Arends wrote: >>> Lutz Donnerhacke wrote on 02/16/2007 09:24:33 AM: >>>> You can run a caching validating on your own system. >>> Isn't that what I was saying ? I just don't want to do all the > recursion. >>> My ISP's resolver can do that. >> So use it for this. > > I just explained why I don't want to do that. > >>> not really. I can also validate on a stub resolver. >> I wouldn't call this "stub". A stub resolver is a protocol translator: > It >> offers an well known API to well known protocol. It does nothing more of > the >> protocol itself. > > I'd call this a "security aware stub resolver" (rfc 4033, section 2). > >>>> Following this proposal in the blog, DNSSEC is dead. >>> Tell me Lutz, how does joe end user run a full featured validating >>> resolver daemon, when he barely understand the concept of DNS. >> The end user has a stub resolver pointing to a trustwothy validating > one. >> It's this plain simple. If you want to break this behavior, DNSSEC is > dead. > > explain to me how DNSSEC is dead by doing validation on a stub resolver. > >>> If he shouldn't run this, how does he setup "a established link to an >>> authenticated resolver". You're not really referring to just an bunch > of >>> addresses in some resolv.conf or equivalent, since thats hardly an >>> established link. The ISP's resolver hardly knows who's talking to it. >> I'm responsible for DNS at an ISP: The ISP's resolver know who queries > it. > > So, what do you offer to your clients? SIG(0), TSIG, DTLS, some VPN method > ? How many clients have configured that ? > And with 'who queries it', you probably mean that you have some list in > place somewhere that discriminates on ip. Note that I can simply passive > query your resolver box. You wouldn't even know it is me. > >>> Now, lets assume for a sec we don't run into scaling issues, since the >>> "authenticated resolver" needs to do some crypto for the "established >>> link", while doing some crypto to validate messages. >> DNSSEC validating on a larger resolver does scale well, because - that's > the >> important observation I made - a lot of queries can be answered from > cached >> NSEC records without querying further. The whole bunch of NXDOMAIN > dropped by >> about 70% here. Crypto is cheap compared to networking. > > I find those last two statements highly unlikely, but for argument sake, > multiply this by cost(crypto(lastmile))*count(users). > >>> Why should I trust data, validated by my ISP? >> Because you choose him to do so. > > Eh ? No, I rely on it to bring me the data. I'll validate it myself, thank > you very much. > >>> Them ISPs route me to a search page, while I should've received an >>> NXDOMAIN. but, no fear, the 'ad' bit is set, and I can just blindly > trust >>> my ISP, while they're cashing (no typo) in on my unfortunate >>> misspellings. >> If you do not trust your ISP, you need an other one or you won > validating >> protocols i.e. VPN to a trustwothy point. > > "trust" is not a binary concept. You need to relate trust to a service, > and then still, it comes in degrees. I trust my bank to process payments. > I trust my ISP to keep my link alive and to have proper peering in place. > I _could_ trust my ISP to serve me the right data, but that would only be > the right data in their perspective, wouldn't it, and that might not match > mine. > >> DNSSEC for end users is not a security issue, it's a deployment issue. > > Eh ? > > DNSSEC is security backfitted on a widely deployed protocol. This has > deployment issues in general. > > Roy > >

7 8

Announcement DNS for LIRs Training Courses
by RIPE NCC Training Services 12 Feb '07

12 Feb '07

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Friday 30 March 2007 Time: 09:00-17:00 Location: Lisbon, Portugal And Date: Friday 20 April 2007 Time: 09:00-17:00 Location: Frankfurt, Germany Hosted by: DE.CIX: http://www.decix.de/ And Date: Friday 27 April 2007 Time: 09:00-17:00 Location: Budapest, Hungary And Date: Friday 18 May 2007 Time: 09:00-17:00 Location: Amsterdam, Netherlands And Date: Friday 8 June 2007 Time: 09:00-17:00 Location: London, United Kingdom And Date: Thursday 21 June 2007 Time: 09:00-17:00 Location: Tehran, Iran The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

Re: Welcome to the "techsec-wg" mailing list
by shyaam＠evilfingers.com 07 Feb '07

07 Feb '07

Hi guys, I am new to the Security Mailing lists at RIPE. Have always been in the anti-spam one. Glad to be in here too. kind Regards, Shyaam

1 0

Announcement DNS for LIRs Training Courses
by RIPE NCC Training Services 31 Oct '06

31 Oct '06

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Friday 26 January 2007 Time: 09:00-17:00 Location: Ljubljana, Slovenia And Date: Friday 9 March 2007 Time: 09:00-17:00 Location: Edinburgh, United Kingdom And Date: Friday 30 March 2007 Time: 09:00-17:00 Location: Lisbon, Portugal The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

Announcement DNS for LIRs Training Courses
by RIPE NCC Training Services 29 Aug '06

29 Aug '06

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Tuesday 5 September 2006 Time: 0900-1700 Location: Reykjavik, Iceland Hosted by: TM-Software http://www.t.is/ And Date: Friday 29 September 2006 Time: 0900-1700 Location: Amsterdam, Netherlands And Date: Friday 27 October 2006 Time: 0900-1700 Location: London, United Kingdom And Date: Tuesday 28 November 2006 Time: 0900-1700 Location: Rome, Italy Hosted by: CASPUR http://www.caspur.it/ Hosted by: NAMEX http://www.namex.it/ And Date: Friday 15 December 2006 Time: 0900-1700 Location: Moscow, Russian Federation The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

hacker
by Doreen 27 Aug '06

27 Aug '06

After receiving a mail from one of my online accounts that someone has been trying to hack it I went to search the IPadress. This is what I found: Query the RIPE Database Search for Switch to the RIPE TEST Database % This is the RIPE Whois query server #2. % The objects are in RPSL format. % % Note: the default output of the RIPE Whois server % is changed. Your tools may need to be adjusted. See % http://www.ripe.net/db/news/abuse-proposal-20050331.html % for more details. % % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html %WARNING:905: fixed lookup key % % The key "090.44.23.169" has been changed to "90.44.23.169" for lookup. % Note: This output has been filtered. % To receive output for a database update, use the "-B" flag % Information related to '90.0.0.0 - 90.127.255.255' Inetnum: 90.0.0.0 - 90.127.255.255 Netname: FR-TELECOM-20060302 Org: ORG-FT2-RIPE Descr: France Telecom Country: FR Admin-c: MB5714-RIPE Admin-c: AB5579-RIPE Tech-c: PG5119-RIPE Tech-c: ML2808-RIPE Status: ALLOCATED PA Mnt-by: RIPE-NCC-HM-MNT Mnt-lower: RAIN-TRANSPAC Mnt-lower: FT-BRX Mnt-routes: FT-BRX Mnt-routes: RAIN-TRANSPAC Source: RIPE # Filtered Organisation: ORG-FT2-RIPE Org-name: France Telecom Org-type: LIR Address: 6, Place d'Alleray Address: 75505 Address: Paris Cedex 15 Address: France Phone: +33 1 44 44 27 75 Fax-no: +33 1 44 44 24 37 E-mail: Alain.bidron(a)francetelecom.com E-mail: gestionip.ft(a)francetelecom.com Admin-c: MB5714-RIPE Admin-c: AB5579-RIPE Admin-c: ML2808-RIPE Admin-c: PG5119-RIPE Admin-c: QNN1-RIPE Mnt-ref: OLEANE-NOC Mnt-ref: FT-BRX Mnt-ref: RAIN-TRANSPAC Mnt-ref: RIPE-NCC-HM-MNT Mnt-by: RIPE-NCC-HM-MNT Source: RIPE # Filtered Person: Maryline Bourasseau Address: France Telecom Address: BRX/DAP/AFC Address: Branche Reseaux Address: 6, Place d'Alleray Address: 75505 Paris Cedex 15 Address: France Phone: +33 1 55 41 61 53 Fax-no: +33 1 44 44 24 37 E-mail: maryline.bourasseau(a)francetelecom.fr Nic-hdl: MB5714-RIPE Remarks: secretary: Annick Tandavarayen +33 1 44 44 46 60 Remarks: (Alain Bidron: +33 1 44 44 27 75) Mnt-by: FT-BRX Source: RIPE # Filtered Person: Alain Bidron Address: France Telecom Address: BRX/DAP/AFC Address: Branche Reseaux Address: 6, Place d'Alleray Address: 75505 Paris Cedex 15 Address: France Phone: +33 1 44 44 27 75 E-mail: Alain.Bidron(a)francetelecom.com Nic-hdl: AB5579-RIPE Remarks: secretary: Annick Tandavarayen +33 1 44 44 46 60 Mnt-by: FT-BRX Source: RIPE # Filtered Person: Marc Lapeyre Address: France Telecom Address: ROSI/DRSA/DOR/CSS Address: 13, quai Gailleton - BP 2216 Address: 69214 LYON CEDEX 02 Phone: +33 4 72 87 10 25 Fax-no: +33 4 72 87 10 15 E-mail: Marc.lapeyre(a)francetelecom.com Nic-hdl: ML2808-RIPE Mnt-by: FT-BRX Source: RIPE # Filtered Person: Philippe Gheeraert Address: France Telecom Address: ROSI/DRSA/DOR/CSS Address: 13, quai Gailleton - BP 2216 Address: 69214 LYON CEDEX 02 Phone: +33 4 72 87 10 47 Fax-no: +33 4 72 87 10 15 E-mail: Philippe.gheeraert(a)francetelecom.com Nic-hdl: PG5119-RIPE Mnt-by: FT-BRX Source: RIPE # Filtered I ld like to inform you that this is an IPadress coming from you. In the end all seems to be ok as this IPadress didn't manage to enter the account. I don't know if this IPadress has more complaints against him/her, yet I thought you all should know. If this continues I ll keep you posted. Best regards, Doreen Meeus

1 0

Announcement DNS for LIRs Training Course
by RIPE NCC Training Services 09 May '06

09 May '06

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: And Date: Tuesday 13 June 2006 Time: 0900-1700 Location: Riyadh, Saudi Arabia Hosted by:ZAJIL International Telecommunications Co. W.L.L. And Date: Thursday 13 July 2006 Time: 0900-1700 Location: Munich, Germany And Date: Friday 8 September 2006 Time: 0900-1700 Location: Manchester, United Kingdom And Date: Friday 29 September 2006 Time: 0900-1700 Location: Amsterdam, Netherlands The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0

Announcement DNS Training Course
by RIPE NCC Training Services 07 Feb '06

07 Feb '06

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Monday 10 April 2006 Time: 09:00 17:00 Location: London, United Kingdom And Date: Thursday 11 May 2006 Time: 09:00 17:00 Location: Amsterdam, Netherlands And Date: Tuesday 13 June 2006 Time: 09:00 17:00 Location: Riyadh, Saudi Arabia Hosted by:ZAJIL International Telecommunications Co. W.L.L. And Date: Thursday 22 June 2006 Time: 09:00 17:00 Location: Munich, Germany The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC __________ RIPE NCC Online Learning...at your own pace in your own space https://e-learning.ripe.net

1 0

Announcement DNS Training Course
by RIPE NCC Training Services 13 Dec '05

13 Dec '05

Dear Colleagues, The RIPE NCC Training Services Department invites you to register for one of our upcoming DNS for LIRs Training Courses: Date: Friday, 27 January 2006 Time: 09:00 17:00 Location: Limassol, Cyprus And Date: Wednesday, 15 February 2006 Time: 09:00 17:00 Location: Manama, Bahrain Hosted by: 2Connect: http://www.2connectbahrain.com/ The main objective of the DNS for LIRs Training Course is to provide LIRs with information about the different DNS related services the RIPE NCC has available for them. It covers reverse DNS procedures and checks, as well as giving information about DNS Monitoring (DNSMON), K-Root and anycasting. The course also covers DNSSEC and the specific procedures set up by the RIPE NCC to secure the in-addr.arpa zones. Please note that the DNS for LIRs course focuses on DNS services and procedures related to being an LIR. The course does: - NOT teach the basics of DNS - NOT describe how to receive Internet resources from the RIPE NCC - NOT describe fully how to operate a Local Internet Registry (LIR) The course is intended for technical staff of LIRs. It is assumed that all attendees are familiar with common DNS terminology and have a practical knowledge of operating DNS servers. The course is free of charge. We provide lunch and printed training materials. We do not cover any of your travel expenses or accommodation. We give all of our training courses in English. You can find more information about the course at: http://www.ripe.net/training/dns REGISTRATION: ============ To register for this course, please use the LIR Portal or complete the registration via our website on: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Kanis Training Services Manager RIPE NCC

1 0