Hi guys,
Thanks for the feedback!
I originally posted to Firewalls on Friday and didn't see activity over
the weekend, so I posted to security-basics. Paul daSilva pointed me to
the problem.
$ whois internap.com
[...]
Domain servers in listed order:
NS-A.PNAP.NET 64.94.123.4
NS-B.PNAP.NET 64.94.123.36
NS-C.PNAP.NET 64.95.61.4
NS-D.PNAP.NET 64.95.61.36
[...]
$ nslookup
> server 64.94.123.36
Default server: 64.94.123.36
Address: 64.94.123.36#53
> mail.greenborder.com
Server: 64.94.123.36
Address: 64.94.123.36#53
Name: mail.greenborder.com
Address: 216.52.7.214
The IP returned to the email client was also owned by Internap.
Internap claimed to be authoritive for my domain, and even had a few
fake records. I'm unsure why this happened, but this stopped after an
email to their abuse and noc email addresses. Their DNS servers no
longer return hostnames or claim authority. What I did manage to
capture before the change was a set of false records:
mail.greenborder.com False Address: 216.52.7.214
www.greenborder.com False Address: 216.52.7.212
ftp.greenborder.com False Address: 216.52.7.210
If this was malicious, the next question is how long, what login
information did these systems capture, and what email may have been
intercepted.
I see the changes, but Internap has not replied to my email (dns
problems? ;) ).
Bill Stout
GreenBorder
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Bill Stout
Sent: Friday, January 26, 2007 7:24 PM
To: firewalls@securityfocus.com
Subject: DNS poisoning?
Hello,
I'm working through an intermittent incoming email bounce problem I hope
someone can shed some light on. A few major companies are reporting
intermittent bounces when sending email to us.
Someone forwarded a bounce message which contained the following
information:
... connect to mail.greenborder.com [216.52.7.214]: Connection timed
out ...
I do not have a host named 'mail.greenborder.com' in my DNS records.
The IP address is not a mail server, it's an Internap address.
http://www.dnsstuff.com/tools/whois.ch?ip=216.52.7.214
I tried to obtain help through the DNS experts at Network Solutions
through Customer Support; their Customer Support guys are _absolutely
clueless_ on how DNS works. They keep referring me to 'the provider who
hosts my email service'.
My MX records are here:
http://www.dnsstuff.com/tools/lookup.ch?name=greenborder.com&type=MX
(Temporarily modified for troubleshooting purposes)
greenborder.com. MX IN 7200 USC1.MAILHOSTSXODE.NET. [Preference = 10]
greenborder.com. MX IN 7200 MAILGATE.greenborder.com. [Preference = 1]
greenborder.com. MX IN 7200 USP1.MAILHOSTSXODE.NET. [Preference = 5]
greenborder.com. NS IN 7200 NS31.WORLDNIC.com.
greenborder.com. NS IN 7200 NS32.WORLDNIC.com.
MAILGATE.greenborder.com. A IN 7200 66.123.15.52
Any help would be appreciated.
TIA,
Bill Stout
