Hey Ralf,
You beat me to it, after Lode's post, I was gradually going through them
all, but time was not on my side, and well, I only managed to get to
MIL, but I can confirm that from AC-MIL are not false positives, as I
have the same one's.
As for what to think about this, well, it is rather worrying, and should
be stopped, but what would be a good way to go about getting this sorted
out?
Wonder if it would be worthwhile filing something on bugtraq to get it
out there, yeah I know that things on there aren't usually this big, but
it may force the admins to do something about it?
If you want to discuss this further off the list feel free to mail me
direct.
xyberpix
On Wed, 2004-12-29 at 17:32 +0100, Ralf Glauberman wrote:
Hello all,
after Lode Vermeiren having published on the 7th of December that many
tlds are transferable I did further research on this. Much to my
surprise this wasn't just a problem of little states. i did a complete
scan on all tlds (http://data.iana.org/TLD/tlds-alpha-by-domain.txt)
including every soa and ns server. i got results from 141 out of the
258 checked tlds. i din't check every single output, but there are not
more than 10 false-positives within these. while the ca zone is secure
now, i was really surprised that be (~ 42 MB, ~ 900.000 records) and
fi (~ 11 MB, ~ 235.000 records) are transferable.
all in all, i found that the following tlds are transferable (also
there might be some false-positives):
AC
AD
AG
AL
AN
AO
AR
ARPA
BA
BD
BE
BF
BG
BI
BJ
BM
BN
BO
BS
BT
BV
BW
CF
CI
CK
CM
CU
CV
CY
DJ
DZ
EC
EE
EG
ER
ES
ET
FI
FJ
FK
FM
GA
GB
GD
GE
GH
GL
GN
GP
GQ
GS
GT
GU
GW
GY
HN
IL
IN
INT
IO
JM
JO
KE
KG
KH
KI
KM
KN
KR
KY
KZ
LB
LC
LK
LR
LY
MA
MC
MD
MG
MH
MIL
MM
MN
MR
MS
MT
MUSEUM
MW
MX
MY
MZ
NA
NC
NE
NG
NI
NP
OM
PE
PG
PK
PY
SG
SH
SJ
SK
SM
SN
SO
SR
ST
SU
SV
SZ
TC
TD
TH
TJ
TM
TN
TO
TP
TR
TT
TZ
UA
UG
UK
UM
UY
VA
VC
VE
VG
VI
VU
YE
YU
ZA
ZW
so, here comes the old question: What do you think about this?
Best regards,
Ralf Glauberman
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
--
For Security and Open Source news and tips visit:
http://www.xyberpix.com
signature.asc
Description: This is a digitally signed message part
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
