It seems that the more people I talk to, the more I recongize a “hatred” against attorney’s in this country. Sure — in California last summer I saw a sign stating “Welcome to California — The Sue You State”, but I don’t think that really explains what’s going on in regards to the legal problems in this country.In some cases, I would agree with an eposide of “The Simpsons” where an attorney is run over and asks to be remembered as “a drain on society”. Sure, there are many lawsuits out there which I view as friviolous — especially in regards to individuals suing each other for “damages” which are purely accidental, and indivdiuals suing companies for millions of dollars of damages which are likely unjustifiable in many cases. According to a German individual who I worked with last year, in Europe they laugh when they hear about the amount of money which is awarded in some US lawsuits. At the same time, the Japanese typically don’t sue at all — their culture simply doesn’t view it as “the right way” to proceed.
However, when I look at the work done by an organization such as EFF (Electronic Frontier Foundation), ACLU, or many of the other organizations I’m part of, I recongize the importance of legal work in many scanarios — which is perhaps why I’m interested in becoming an attorney myself. And while I’ve read many ‘annoying’ court cases over the years, this one really does it: http://www.circleid.com/posts/811611_david_ritz_court_spam/.
As the article describes, the individual mentioned (David Ritz) has been prosecuted for performing a zone transfer (AXFR) of DNS information, along with utilizing various other network tools.
Without getting incredible technical, a zone transfer is similar to me handing you a document listing all of the names of the people who live on a street. A “zone” holds information about a domain (i.e, schlinky.com) and all of the different services under it (i.e, blog.schlinky.com). Nothing more, nothing less.
Here, lets perform a zone transfer right now:
http://www.dollardns.net/cgi-bin/dnscrawler/index.pl?server=a.root-servers.net&name=msn.com&type=AXFR&class=IN&lr=12&submit=Send+Query
Oh wait… you can’t perform a zone transfer on msn.com. Apparently MSFT has admins which correctly (well, not technically ‘correctly’, theres no formal RFC or standard for this) lock down their DNS servers.
Let’s try another.
http://www.dollardns.net/cgi-bin/dnscrawler/index.pl?server=a.root-servers.net&name=mydomain.com&type=AXFR&class=IN&lr=12&submit=Send+Query
Hey… look at that. We were able to transfer the zone for mydomain.com. Now, according to the court ruling which was issued, what I just did broke the law (nice…). So, what’d we get? In general, the list of information tells us a name of a site under the zone, what type of record it is, and then the data associated with that record (typically an IP address as A records are most common).
For instance:
I now know that mydomain.com is hosted on two different IP addresses, setup in a round-robin DNS enviorment. Whoopdie do. I could have gotten that with a general ping also, or just with an ALL request without the need to transfer the entire zone, but whatever.
Now, there is a few interesting things which I can see via the zone transfer:
These all look interesting. I have no idea why you would have fun.mydomain.com or fig.mydomain.com — and if I snooped around enough I might find some sort of purpose (i.e, perhaps they are test sites being used by admins and could be a potential security risk if not locked down correctly). beta.mydomain.com could easily be a testing site — hopefully that’s locked down correctly also since you wouldn’t want someone attempting to break the security of your beta.
Hmm, looks like they’ve got some sort of a promo website being built also. Hopefully thats correctly locked down — wouldn’t want people using promotions which should’nt be accessible yet.
Besides for what I’ve mentioned above, there is nothing particularly interesting about this domain. I can see its mail servers and get a general idea of the infrastructure associated with this company, but this is no golden key (unless one of the aformentioned sites isn’t correctly locked down).
Now, why would you want to do something like this? Debugging is one — I commonly perform AXFRs when I’m attempting to determine a network problem. Sometimes I will see a round-robin enviorment and change my host file to utilize the other system if I detect one of the servers which is part of the robin is down. Other times, I will utilize when I’m setting up my own network — I had to query the DNS data of the Exchange hosting provider which I outsource for my business in order to correctly setup my domains SPF records.
There’s no real “security problem” associated with zone transfers — assuming that you have competent administrators who lock down the items under DNS. However, sometimes it can just be best to disable them on the domain — something which is easily achieved (as shown by the transfer attempt on msn.com above). For instance, a company might have an Asterisk / VoIP server on their domain. If I transfer their domain and see voice01.company.com — I now know the servers information. If I had malicious intentions, I could attempt a DoS or DDoS attack against that server in an attempt to bring down the companies voice network. The end result is that transfering zone data only has the potential to help you find a security risk — its not actually a security problem itself.
David Ritz did exactly what I just did (ie, AXFR DNS data from a zone). The court documents mention it under the “Statements of Fact”.
———————
“On February 27, 2005, David Ritz (”Ritz”) connected to Sierra’s DNS server. In the course of that connection, he issued a host -l command which requested a zone transfer from Sierra’s DNS server. Sierra’s server responded with a full zone transfer, providing Ritz with the network map showing all of Sierra’s private domain names, private host names, and internal non-routable IP addresses.”
———————
Yeah, ok. He used the ”host -l” command to perform his transfer. I used the DNSCrawler website to make it easier for me to demonstrate what I’m talking about. However, knowing the owner of that system, he most likely has that perl script using the host -l command in the background and is then just reporting it back to the web interface. The rest of that statement is indeed what we just got on ’mydomain.com’ — a network map of the system. Now, what “private” domain names he recieved I have no idea. As far as I’m concerned, everything we just saw was completly public and publically accessible. It also mentions internal non-routable IP addresses — ie, the IP addresses used by the computers inside of the company — ones which don’t typically interface with the public internet. Why those IP addresses were in the same zone file as sierra’s main zone is a mystery to me — it sounds like we some real crack-pot DNS admins here. But in any case, putting them into the same zone file, or even on any publically accessible DNS server in a zone which can be AXFRed makes those addresses publically accessible in my mind.
To shut-up anyone who claims I’m not using the ‘host -l’ command because I’m afraid of committing some sort of crime:
———————
[root@node101 ~]# host -l mydomain.com ns1.mydomain.com
Using domain server:
Name: ns1.mydomain.com
Address: 64.94.117.193#53
Aliases:
mydomain.com name server ns1.mydomain.com.
mydomain.com name server ns2.mydomain.com.
mydomain.com name server ns3.mydomain.com.
mydomain.com name server ns4.mydomain.com.
dev.mydomain.com has address 216.34.94.184
ns1.mydomain.com has address 64.94.117.193
ns2.mydomain.com has address 64.94.31.67
ns3.mydomain.com has address 66.150.161.137
ns4.mydomain.com has address 63.251.83.74
ns5.mydomain.com has address 64.94.117.199
ns6.mydomain.com has address 63.251.83.72
redirect.mydomain.com has address 216.34.94.186
mydomain.com has address 216.34.94.184
mydomain.com has address 66.150.120.131
*.mydomain.com has address 216.34.94.184
chat.mydomain.com has address 64.85.73.20
forum.mydomain.com has address 216.34.94.181
promo.mydomain.com has address 216.148.213.147
bounce.mydomain.com has address 64.85.73.100
mkt.mydomain.com has address 64.85.73.100
notification.mydomain.com has address 64.85.73.28
renewals.mydomain.com has address 64.85.73.28
lists.mydomain.com has address 216.234.106.37
lyradmin.mydomain.com has address 216.234.106.44
mailix.mydomain.com has address 216.148.213.134
webmail.mydomain.com has address 216.148.221.141
webmail2.mydomain.com has address 216.148.221.133
webmail3.mydomain.com has address 216.148.221.132
images.mydomain.com has address 216.34.94.185
scripts.mydomain.com has address 216.148.221.140
beta.mydomain.com has address 193.230.129.57
fig.mydomain.com has address 216.34.94.184
fun.mydomain.com has address 216.34.13.250
newsletter.mydomain.com has address 216.112.64.102
partner.mydomain.com has address 216.34.13.250
sitescope.mydomain.com has address 216.148.221.156
afs.mydomain.com has address 216.148.221.143
cadomains.mydomain.com has address 216.34.94.177
members.mydomain.com has address 212.100.224.151
training.mydomain.com has address 212.100.224.151
tutorials.mydomain.com has address 212.100.224.151
securemx.mydomain.com has address 216.148.213.147
———————
But according to the court documents, Rizo also performed some other terrible actions
———————
“At various other times, Ritz issued a variety of commands, including host -l, helo, and vrfy. The afore-mentioned commands are not commonly known to the average computer user.”
———————
Goodness — this guy is doing things which are not known to the average computer (individual) user? And my god, that chemist over there is performing titrations which the average individual can’t do either. This is terrible!! Both of these people must be bent on destroying this country!
Ok people — lets look at what each of those commands do. “helo” is a command utilized by mail servers — infact, its used by every mail server which wants to be able to communicate via SMTP — the most popular mail protocal on the planet. So when you send grandma at rocker1154grandma@gmail.com those pictures of you and your friends on the beach, the mail server which talks from your provider (lets say Comcast) to her provider (gmail) must utilize the “helo” command.
Since that might not mean much to you, lets do it outselves to understand the terrible crime this man committed. To keep things in track, lets talk to the mail server of mydomain.com — which we know according to the DNS records from above is mx.mailix.net.
———————
[root@node101 ~]# telnet mx.mailix.net 25
Trying 216.148.221.135…
Connected to mx.mailix.net (216.148.221.135).
Escape character is ‘^]’.
220 mx.mailix.net ESMTP Exim 4.63 Fri, 18 Jan 2008 23:20:02 -0800
———————
Wow, all of that code. Must be something BIG. Real big! But its not — basically what just happened is I connected to the mail server, and it gave me a 220 message — its way of announcing itself, along with the protocol we can use to talk (ESMTP) and the mail server its running (Exim 4.63). Oh, and it mentions its current time… hizzah hizzah.
Let’s run the helo command here.
———————
helo node101
250 mx.mailix.net Hello node101 [74.000.000.000] (yeah, I blocked out my IP)
———————
Check that out people — another crime. I told the mail server that my name was node101, and it responded with a 250 message greeting me (mail servers are just so nice!).
Now, what’s this vrfy stuff. Well, vrfy is just a method used to verify that a user exists on a remote domain. So, if Comcast is talking to GMail, they want to verify that rocker1154grandma@gmail.com exists before they try to send the mail. Just terrible. Lets try and verify that postmaster@mydomain.com exists.
———————
VRFY <postmaster@mydomain.com>
252 Administrative prohibition
———————
Now, that was unexpected. I attempted to verify that the address postmaster@mydomain.com exists, and I got back an 252 “Administrative prohibition” message — basically saying that the mailserver has been configured to refuse to perform this action. Not sure why, but the admins for that mail server don’t want us to be able to check the status of a mailbox with VRFY. Thats ok though — we can do it another way.
———————
MAIL FROM: <bschlinker@blog.schlinky.com>
250 OK
RCPT TO: <postmaster@mydomain.com>
250 Accepted
———————
So, I told the mailserver “hey — its bschlinker@blog.schlinky.com — I wanna send some email to postmaster@mydomain.com — is that cool?”. The server responded by accepting the destination, so it worked.
Anyways, this guy must have done something else. Let’s go back to those court papers:
———————
Ritz frequently accomplished his access to Sierra’s computers by concealing his identity via proxies and by accessing the servers via a Unix operating system and using a shell accounts, among other methods. He also disguised himself as a mail server.
———————
That’s interesting — we just did everything on there — except for the proxies part. I guess I could go ahead and do that, but there is no “law” against annoymous internet communications anyways. I don’t see why that’s even a factor here. And yes folks — I did just “disguise” myself as a mail server — except for how mailservers don’t typically mistype while I did a few moments ago.
———————
In the late winter or spring of 2005, Ritz published the zone information he copied from Sierra’s server in the form of a file he published by making it accessible to the Internet and which he named “zilla_queries” (”zilla queries file”) — that file contained the internal domain structure of Sierra.
———————
Alrighty then. I officially proclaim the zone-transfer which I performed above of “mydomain.com” to be known as the “zilla_queries2″ file. You can even download it — I have uploaded it in .txt format to this entry. Good stuff.
http://blog.schlinky.com/wordpress/wp-content/uploads/2008/01/zilla_queries2.txt
Now, we’re done with the technical analysis of this one. The rest I’ll cover in my next post discussing how Sierra claims this hurt their security, etc.