Checking if your DNS has been compromised

Worry about July 9, 2012? Check your DNS.

The simplest solution. Visit http://www.dns-ok.us and if you see a green background, you are ok. If the background is red, you might be in trouble.

Want to do the check manually? Do this

Open a command window and at the prompt, type or paste:

ipconfig/allcompartments/all

The output will probably be very long. Look for the IPv4 information under “Ethernet adapter…” Then Look for the “DNS Servers line, and write down these numbers. “Compare them with the IP numbers of the malicious Rove DNS changer listed in http://www.dcwg.org/detect/checking-windows-7-for-infections/

If a match, you might be in trouble.

On Telneting and other nifty protocols

I’ve installed a new server and few services using Windows Vista. These do not come pre-activated and must be installed. This morning I feel like sharing so this post goes.

 

In Windows Vista, you need to install the Telnet Client:

1. Navigate to Start > Control Panel > Programs > Programs and Features > Turn Windows features on or off.  If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

2. In the Windows Features dialog box, select the Telnet Client check box.

3. Click OK. The installation might take several minutes.

 

Other nifty installs available are

RIP Listener

SNMP

Simple TCPIP services

Telnet Server

TFTP Client

 

 

Google DNS Services: The Google Internet?

DNS is one of  the nerves of the Internet as it is used to resolve IP addresses to numbers. This is a critical service provided by ISPs and domain name registrar services.

Apparently Google is taking a step closer to become The Internet by providing free, open DNS services to any web site in the world. This news is making nervous almost all ISP providers, domain registrar companies, and large organizations like Microsoft.

http://www.pcmag.com/article2/0,2817,2356618,00.asp

They claim they are doing it to speed up the Web and to improve security (DOS, DNS Cache, DNS request attacks, topics covered in the Internet Engineering 1 course).

http://code.google.com/speed/public-dns/docs/intro.html

http://code.google.com/speed/public-dns/docs/security.html

Their DNS service  might evolve into a global connectivity ecosystem.

That’s scary.

IRW:2009-11: Subnetting and Security

The current issue of IRW arrived last week to subscribers. Look what non-subscribers missed:.

Featuring article: Subnetting and Security

“The purpose of subnetting is to break large networks into smaller networks called subnets by borrowing bits from the network portion of an IP address. This is done by using a variable length subnet mask. As the IP addresses of host computers on each subnet are masked by the network address these are invisible to those outside the network. In this sense, subnetting benefits security. Conversely, the cost of misconfigured subnets creates Internet vulnerabilities. For those working at the intersection of Information Security, IP address masking and subnetting might be relevant when it comes to analyzing spoofing, penetration hacking, and subnet advertisements. Accordingly, in this issue of the newsletter we present a straightforward approach on the art of subnetting.”

Enjoy it.

IP Packet Fragmentation, MTU, and MSS Tutorials

Two new tutorials on Internet Engineering are available now from Mi Islita.com:

IP Packet Fragmentation Tutorial [pdf]

MTU and MSS Tutorial [pdf]

Both are based on lecture material provided in class during the IE Part 1 course. These can be used as reference material for other courses such as Network Security, Internet Engineering, Internet Architecture, etc.

The first one is an introduction to packet fragmentation analysis while the second one delves into experimental techniques on maximum transmission unit and maximum segment size calculations.

The tutorials can be used to understand Ping of Death, Fragmentation Offset Attacks, Tiny Fragmentation Attacks, Firewall Fragmentation Attacks and other forms of hacks.

Enjoy it.

DNS Intelligence

Today’s Internet Engineering Part 1 course lecture will be on DNS Intelligence and how we can use DNS records to understand virus and worm attacks as well as remote network topologies. Quite handy these days.

Please check Lecture 8

All About Email Headers

If you are enrolled in the IE-Part 1 course, here is some reference material on Email Headers for today’s lecture:

Exposing email headers

http://www.abs-comptech.com/EmailHeaders.htm

Tracking the source of email spam

http://www.rahul.net/falk/mailtrack.html

How to read email headers

http://www.emailaddressmanager.com/tips/header.html

Reading the email header

http://antivirus.about.com/od/windowsbasics/a/emailheaders.htm

Reading email headers

http://www.tinhat.com/email/read_email_headers.html

Spamlinks: Reading email headers

http://spamlinks.net/track-trace-headers.htm

ACCC: Reading Email Headers

http://www.uic.edu/depts/accc/newsletter/adn29/headers.html

E-mail Headers and SMTP Commands

http://www.avolio.com/columns/E-mailheaders.html

All About Email Headers

http://www.stopspam.org/index.php?option=com_content&view=article&id=45&Itemid=56

Security Optimization Strategies in the Workplace

http://www.miislita.com/searchito/security-optimization-strategies.html

Email Protocols

If you are a student enrolled in the Internet Engineering I graduate course, check the Lecture 7 update.

We will be covering email protocols such as SMTP, POP3, and IMAP. The exercise section covers email headers intelligence and email crawlers.

DNS Configuration

If you are a student enrolled in the Internet Engineering I graduate course, check the Lecture 6 update.

I will be covering all about DNS configuration files. For the hands-on exercise section, we will be using nslookup commands to snoop at all relevant records of remote Web domains.

Use nslookup/? to access the options helper
Use nslookup followed by ? in a different line to access the commands helper
To quit nslookup, press ctrl C or either type quit or exit.

Migrating from IPv4 to IPv6: The Next Nightmare?

Two weeks ago, venerable Vinton Cerf urged the Internet community to migrate from IPv4 to IPv6. According to Cerf, co-designer of the TCP/IP protocols, IPv4 will run out of addresses next year or in early-2011.

However, there is a problem.

Back in March, it was reported of an allegued Fatal Flaw for IPv6: it’s Not Backwards Compatible

Both news are equally intriguing.

IPv6 migration: Your Next Nightmare?