International DNS compromise?
Dear all,
Recently I noticed something fishy in the DNS system
between US and China.
First, any IPs, dead or live, in China will respond
to your DNS query for some domains. For example
(screen shot with some clean-up and comments):
C:\>nslookup
> server 210.77.0.0 <=== pick a random IP in
China
Default Server: [210.77.0.0]
Address: 210.77.0.0
> www.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0
Non-authoritative answer:
Name: www.rfa.org
Address: 203.105.1.21 <=== you got response!!!!
Second, every time the response is different:
> www.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0
Non-authoritative answer:
Name: www.rfa.org
Address: 64.66.163.251
> www.rfa.org
Non-authoritative answer:
Name: www.rfa.org
Address: 64.33.99.47
> www.rfa.org
Non-authoritative answer:
Name: www.rfa.org
Address: 128.121.126.139
Third, you can even get response from non-exist host
names:
> nosuchhost.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0
Non-authoritative answer:
Name: nosuchhost.rfa.org
Address: 65.104.202.252
> nosuchhost.rfa.org
Non-authoritative answer:
Name: nosuchhost.rfa.org
Address: 64.33.99.47
What on earth is really going on here? It seems the
DNS system is messed up between US and China, and its
integrity is compromised. People can be unknowingly
redirected to any where ...
--Zhen
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo