<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">Hi all,<br>I have asked the management (Administrative and Techincal Contacts) for the .ug to make an official statement on this; i will post their response on what happened, how they fixed it, how much downtime as well as safeguards that are in place to subvert any such attacks in the future asap.<br><br>Regards,<br>Douglas onyango +256(0712)981329<br>
If you are not part of the solution, your are part of the Problem.<br><br>--- On <b>Mon, 5/18/09, africann-request@afrinic.net <i><africann-request@afrinic.net></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>From: africann-request@afrinic.net <africann-request@afrinic.net><br>Subject: AfrICANN Digest, Vol 27, Issue 18<br>To: africann@afrinic.net<br>Date: Monday, May 18, 2009, 7:04 PM<br><br><div class="plainMail">Send AfrICANN mailing list submissions to<br> <a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a><br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="https://lists.afrinic.net/mailman/listinfo.cgi/africann" target="_blank">https://lists.afrinic.net/mailman/listinfo.cgi/africann</a><br>or, via email, send a message with subject or body 'help'
to<br> <a ymailto="mailto:africann-request@afrinic.net" href="/mc/compose?to=africann-request@afrinic.net">africann-request@afrinic.net</a><br><br>You can reach the person managing the list at<br> <a ymailto="mailto:africann-owner@afrinic.net" href="/mc/compose?to=africann-owner@afrinic.net">africann-owner@afrinic.net</a><br><br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of AfrICANN digest..."<br><br><br>Today's Topics:<br><br> 1. Streaming announcement for posting on website and mailing<br> lists (Stephanie Moorghen-Bernon)<br> 2. Re: [afnog] [AfrICANN-discuss] Google blames DNS insecurity<br> for Web site defacements (SM)<br> 3. Re: [afnog] Google blames DNS insecurity for Web site<br> defacements (Calvin
Browne)<br> 4. Child Protection Online (Eric M.K Osiakwan)<br> 5. Re: Re: [afnog] Google blames DNS insecurity for Web site<br> defacements (Dr Yassin Mshana)<br> 6. Re: [afnog] Google blames DNS insecurity for Web site<br> defacements (Atef LOUKIL)<br><br><br>----------------------------------------------------------------------<br><br>Message: 1<br>Date: Mon, 18 May 2009 14:28:45 +0400<br>From: "Stephanie Moorghen-Bernon" <<a ymailto="mailto:stephanie@afrinic.net" href="/mc/compose?to=stephanie@afrinic.net">stephanie@afrinic.net</a>><br>Subject: [AfrICANN-discuss] Streaming announcement for posting on<br> website and mailing lists<br>To: <<a ymailto="mailto:announce@afrinic.net" href="/mc/compose?to=announce@afrinic.net">announce@afrinic.net</a>>, <<a
ymailto="mailto:member-discuss@afrinic.net" href="/mc/compose?to=member-discuss@afrinic.net">member-discuss@afrinic.net</a>>,<br> <<a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a>><br>Message-ID: <002e01c9d7a3$74b0ba70$5e122f50$@net><br>Content-Type: text/plain; charset="utf-8"<br><br>Dear All,<br><br>Please find attached our streaming announcement concerning the AfNOG-10 / AfriNIC-10 meetings, from the 19 to the 21 May 2009.<br><br>Best Regards,<br><br><br>Stephanie Moorghen-Bernon<br>Events Coordinator & Membership Liaison Officer<br>AfriNIC<br>Tel: (230) 466 6616<br><br><br><br>-------------- next part --------------<br>A non-text attachment was scrubbed...<br>Name: streaming_announcement.rtf<br>Type: text/rtf<br>Size: 1729 bytes<br>Desc: not available<br>Url : <a
href="https://lists.afrinic.net/pipermail/africann/attachments/20090518/d70dc187/streaming_announcement-0001.bin" target="_blank">https://lists.afrinic.net/pipermail/africann/attachments/20090518/d70dc187/streaming_announcement-0001.bin</a><br><br>------------------------------<br><br>Message: 2<br>Date: Mon, 18 May 2009 03:52:13 -0700<br>From: SM <<a ymailto="mailto:sm@resistor.net" href="/mc/compose?to=sm@resistor.net">sm@resistor.net</a>><br>Subject: Re: [afnog] [AfrICANN-discuss] Google blames DNS insecurity<br> for Web site defacements<br>To: <a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a><br>Message-ID: <<a ymailto="mailto:6.2.5.6.2.20090518030248.0597e990@resistor.net" href="/mc/compose?to=6.2.5.6.2.20090518030248.0597e990@resistor.net">6.2.5.6.2.20090518030248.0597e990@resistor.net</a>><br>Content-Type: text/plain; charset="us-ascii";
format=flowed<br><br>At 02:55 18-05-2009, Dr Yassin Mshana wrote:<br>>Now we are talking at last....is is or is there not a security issue?<br><br>This is a security issue.<br><br>>There have been a number of calls for a detailed technical <br>>description of what happened. Can someone in the technical side of <br>>activities please spare some minutes to educate us the concerned <br>>non-technical-users?<br><br>When you register a domain, you also have to specify the nameservers <br>for it. These nameservers are queried (DNS) to find the IP address <br>of the web server where the domain is hosted. Someone gained access, <br>through a programming error, to the site where the nameservers for <br>these domains are specified. The person changed the names of the <br>nameservers to other name servers under his/her control. Once they <br>did that, they had control over the domain and they could point it to <br>a site they
were running. If you visited the web site for the <br>domain, you would still see the name of the domain in the address bar <br>of your browser. But you will get a different web page.<br><br>Let's say that you registered a domain called example.com. The <br>nameservers for example.com are ns1.example.net and <br>ns2.example.net. The actual web site (www.example.com) is hosted on <br>a server at IP address 192.0.2.1. When you type <br><a href="http://www.example.com/" target="_blank">http://www.example.com/</a> in your browser, your computer will connect <br>to IP address 192.0.2.1 and display the web page.<br><br>I change the nameservers for example.com without your authorisation <br>and set them to my nameservers (ns1.example.org and <br>ns2.example.com). ns1.example.org and ns2.example.org return a <br>different IP address (192.0.2.202) when they are queried for the IP <br>address of the www.example.com. When
you type <br><a href="http://www.example.com/" target="_blank">http://www.example.com/</a> in your browser, your computer will now <br>connect to IP address 192.0.2.202 and display the web page. As I am <br>running the server at IP address 192.0.2.202, I got you to visit a <br>different web site and you won't notice that it is not the web site <br>you intended to go to. I could get you to download a virus to your <br>computer or else capture your login credentials if you generally have <br>to provide a user name and password to access content on the web site.<br><br>Regards,<br>-sm <br><br><br><br>------------------------------<br><br>Message: 3<br>Date: Mon, 18 May 2009 14:15:34 +0200<br>From: Calvin Browne <<a ymailto="mailto:calvin@orange-tree.alt.za" href="/mc/compose?to=calvin@orange-tree.alt.za">calvin@orange-tree.alt.za</a>><br>Subject: [AfrICANN-discuss] Re: [afnog] Google blames DNS insecurity<br> for
Web site defacements<br>To: Bill Woodcock <<a ymailto="mailto:woody@pch.net" href="/mc/compose?to=woody@pch.net">woody@pch.net</a>><br>Cc: <a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a>, <a ymailto="mailto:afnog@afnog.org" href="/mc/compose?to=afnog@afnog.org">afnog@afnog.org</a><br>Message-ID: <1242648934.11374.3.camel@calvin-viao2><br>Content-Type: text/plain<br><br>On Mon, 2009-05-18 at 03:26 -0700, Bill Woodcock wrote:<br><SNIP><br>> Thank you very much for the detailed information, that helps everyone <br>> better understand how to secure their operations.<br>> <br>> I've only seen reports of successful SQL compromises of the following <br>> ccTLDs:<br>> <br>> EC (Ecuador)<br>> MA (Morocco)<br>> NZ (New Zealand)<br>> PR (Puerto Rico)<br>> TN (Tunisia)<br>> UG (Uganda)<br><br>Does it appear these were
co-ordinated?<br>are these registries running the same software?<br><br>having a co-ordinated attack against different bespoke software would be<br>way interesting.<br><br>regards<br><br>--Calvin<br><br><br><br>------------------------------<br><br>Message: 4<br>Date: Mon, 18 May 2009 12:56:23 +0300<br>From: "Eric M.K Osiakwan" <<a ymailto="mailto:emko@internetresearch.com.gh" href="/mc/compose?to=emko@internetresearch.com.gh">emko@internetresearch.com.gh</a>><br>Subject: [AfrICANN-discuss] Child Protection Online<br>To: <a ymailto="mailto:AfricanCyberInfoNetwork@afrispa.org" href="/mc/compose?to=AfricanCyberInfoNetwork@afrispa.org">AfricanCyberInfoNetwork@afrispa.org</a>, <a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a><br>Message-ID:<br> <<a ymailto="mailto:B3A9D92A-3C8A-48E8-9711-A0325513B84D@internetresearch.com.gh"
href="/mc/compose?to=B3A9D92A-3C8A-48E8-9711-A0325513B84D@internetresearch.com.gh">B3A9D92A-3C8A-48E8-9711-A0325513B84D@internetresearch.com.gh</a>><br>Content-Type: text/plain; charset="us-ascii"<br><br>Dear All,<br><br>The 17th of May 2009 was World Telecoms and Information Society Day <br>on the theme "Protecting Children Online".<br><br>AfrISPA has just concluded an intense session of work with the ITU, <br>European Broadcasting Association, GSMA and others to develop "Child <br>Online Protection (COP) : Guidelines for Children, Parents, <br>Guardians, Educators, Industry and Policymakers" @ <a href="http://www.itu.int/" target="_blank">http://www.itu.int/</a> <br>osg/csd/cybersecurity/gca/cop/guidelines/index.html - please take <br>time to review and send the necessary comments.<br><br>Eric here<br><br><br>Eric M.K Osiakwan<br>Director<br>Internet Research<br>www.internetresearch.com.gh<br><a
ymailto="mailto:emko@internetresearch.com.gh" href="/mc/compose?to=emko@internetresearch.com.gh">emko@internetresearch.com.gh</a><br>42 Ring Road Central, Accra-North<br>Tel: +233.21.258800 ext 7031<br>Fax: +233.21.258811<br>Cell: +233.24.4386792<br><br><br><br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <a href="https://lists.afrinic.net/pipermail/africann/attachments/20090518/7fd96ccb/attachment-0001.htm" target="_blank">https://lists.afrinic.net/pipermail/africann/attachments/20090518/7fd96ccb/attachment-0001.htm</a><br><br>------------------------------<br><br>Message: 5<br>Date: Mon, 18 May 2009 16:39:40 +0100<br>From: Dr Yassin Mshana <<a ymailto="mailto:ymshana2003@gmail.com" href="/mc/compose?to=ymshana2003@gmail.com">ymshana2003@gmail.com</a>><br>Subject: Re: [AfrICANN-discuss] Re: [afnog] Google blames DNS<br> insecurity for Web site defacements<br>To: <a
ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a><br>Message-ID:<br> <<a ymailto="mailto:627b2fd0905180839m524a0f12g201bbf46779c04ac@mail.gmail.com" href="/mc/compose?to=627b2fd0905180839m524a0f12g201bbf46779c04ac@mail.gmail.com">627b2fd0905180839m524a0f12g201bbf46779c04ac@mail.gmail.com</a>><br>Content-Type: text/plain; charset="utf-8"<br><br>Thanks SM for the description of the Situation. at least now the communities<br>know what to worry about.SECURITY !!!<br><br>2009/5/18 Calvin Browne <<a ymailto="mailto:calvin@orange-tree.alt.za" href="/mc/compose?to=calvin@orange-tree.alt.za">calvin@orange-tree.alt.za</a>><br><br>> On Mon, 2009-05-18 at 03:26 -0700, Bill Woodcock wrote:<br>> <SNIP><br>> > Thank you very much for the detailed information, that helps everyone<br>> > better understand how to secure their operations.<br>> ><br>> >
I've only seen reports of successful SQL compromises of the following<br>> > ccTLDs:<br>> ><br>> > EC (Ecuador)<br>> > MA (Morocco)<br>> > NZ (New Zealand)<br>> > PR (Puerto Rico)<br>> > TN (Tunisia)<br>> > UG (Uganda)<br>><br>> Does it appear these were co-ordinated?<br>> are these registries running the same software?<br>><br>> having a co-ordinated attack against different bespoke software would be<br>> way interesting.<br>><br>> regards<br>><br>> --Calvin<br>><br>> _______________________________________________<br>> AfrICANN mailing list<br>> <a ymailto="mailto:AfrICANN@afrinic.net" href="/mc/compose?to=AfrICANN@afrinic.net">AfrICANN@afrinic.net</a><br>> <a href="https://lists.afrinic.net/mailman/listinfo.cgi/africann" target="_blank">https://lists.afrinic.net/mailman/listinfo.cgi/africann</a><br>><br><br><br><br>-- <br>c/o DFID-Nigeria<br>No. 10 Bobo
Street<br>Maitama<br>Abuja<br>Nigeria<br><br>Skype: yassinmshana1<br>Mobile: +234-803 970 5117<br><br>Do You really NEED TO PRINT THIS? Sure?<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <a href="https://lists.afrinic.net/pipermail/africann/attachments/20090518/1ad70260/attachment-0001.htm" target="_blank">https://lists.afrinic.net/pipermail/africann/attachments/20090518/1ad70260/attachment-0001.htm</a><br><br>------------------------------<br><br>Message: 6<br>Date: Mon, 18 May 2009 16:40:17 +0100<br>From: Atef LOUKIL <<a ymailto="mailto:atef@ati.tn" href="/mc/compose?to=atef@ati.tn">atef@ati.tn</a>><br>Subject: [AfrICANN-discuss] Re: [afnog] Google blames DNS insecurity<br> for Web site defacements<br>To: EL MAAYATI Afaf <<a ymailto="mailto:afaf@anrt.ma" href="/mc/compose?to=afaf@anrt.ma">afaf@anrt.ma</a>><br>Cc: "<a ymailto="mailto:afnog@afnog.org"
href="/mc/compose?to=afnog@afnog.org">afnog@afnog.org</a>" <<a ymailto="mailto:afnog@afnog.org" href="/mc/compose?to=afnog@afnog.org">afnog@afnog.org</a>>, "<a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a>"<br> <<a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a>>, Bill Woodcock <<a ymailto="mailto:woody@pch.net" href="/mc/compose?to=woody@pch.net">woody@pch.net</a>><br>Message-ID: <<a ymailto="mailto:4A118161.4000309@ati.tn" href="/mc/compose?to=4A118161.4000309@ati.tn">4A118161.4000309@ati.tn</a>><br>Content-Type: text/plain; charset="iso-8859-1"<br><br>Dear all,<br><br>> I've only seen reports of successful SQL compromises of the following<br>> ccTLDs:<br>><br>> EC (Ecuador)<br>> MA (Morocco)<br>> NZ (New Zealand)<br>> PR (Puerto
Rico)<br>> TN (Tunisia)<br>> UG (Uganda)<br>> <br>could anybody indicate where we can find these reports of "successful <br>SQL compromises" ???<br><br>Regards,<br><br>_______________________________________________________<br>Atef LOUKIL<br>Tunisian Internet Agency,<br>ATI-LIR&NIC Departement<br>13, Rue Jugurtha Mutuelleville - 1002 Tunis - Tunisia<br>Phone: 216 71 846 100<br>Fax: 216 71 846 600<br><a href="http://www.ati.tn" target="_blank">http://www.ati.tn</a><br><br><br><br>EL MAAYATI Afaf wrote:<br>> Hello everybody,<br>> Concerning ".MA", the origin of the "www.google.co.ma" Web site defacement was an attack which has affected The Registrar Online System.<br>> The Registrar of this domain name, believing that the update of NS entries has been asked by the legitimate user, has transmitted an ordinary request to the Registry.<br>><br>> The vulnerability has been fixed
by the Registrar.<br>><br>> In fact, the incident was occured in the Online Registrar System, which dismisses any security risk related directly to the Registry system.<br>><br>><br>><br>> Regards,<br>> ".MA" ccTLD<br>><br>> -----Original Message-----<br>> From: <a ymailto="mailto:afnog-bounces@afnog.org" href="/mc/compose?to=afnog-bounces@afnog.org">afnog-bounces@afnog.org</a> [mailto:<a ymailto="mailto:afnog-bounces@afnog.org" href="/mc/compose?to=afnog-bounces@afnog.org">afnog-bounces@afnog.org</a>] On Behalf Of Calvin Browne<br>> Sent: Monday, May 18, 2009 12:16 PM<br>> To: Bill Woodcock<br>> Cc: <a ymailto="mailto:africann@afrinic.net" href="/mc/compose?to=africann@afrinic.net">africann@afrinic.net</a>; <a ymailto="mailto:afnog@afnog.org" href="/mc/compose?to=afnog@afnog.org">afnog@afnog.org</a><br>> Subject: Re: [afnog] Google blames DNS insecurity for Web site defacements<br>><br>> On Mon,
2009-05-18 at 03:26 -0700, Bill Woodcock wrote:<br>> <SNIP><br>> <br>>> Thank you very much for the detailed information, that helps everyone<br>>> better understand how to secure their operations.<br>>><br>>> I've only seen reports of successful SQL compromises of the following<br>>> ccTLDs:<br>>><br>>> EC (Ecuador)<br>>> MA (Morocco)<br>>> NZ (New Zealand)<br>>> PR (Puerto Rico)<br>>> TN (Tunisia)<br>>> UG (Uganda)<br>>> <br>><br>> Does it appear these were co-ordinated?<br>> are these registries running the same software?<br>><br>> having a co-ordinated attack against different bespoke software would be<br>> way interesting.<br>><br>> regards<br>><br>> --Calvin<br>><br>><br>> _______________________________________________<br>> afnog mailing list<br>> <a
href="http://afnog.org/mailman/listinfo/afnog" target="_blank">http://afnog.org/mailman/listinfo/afnog</a><br>><br>> Ce message, son contenu et toutes les pi?ces jointes sont adress?s ? l'attention exclusive de leur (s) destinataire (s) et sont strictement confidentiels : ils rel?vent de la correspondance priv?e. Toute publication, utilisation ou diffusion, m?me partielle, par des personnes autres que les destinataires est interdite et doit ?tre autoris?e par l'Agence Nationale de R?glementation des T?l?communications (ANRT, Royaume du Maroc). Si vous recevez ce message par erreur, nous vous prions de le d?truire apr?s en avoir inform? son exp?diteur sans d?lai. L'ANRT d?cline toute responsabilit? pour toute alt?ration, d?formation ou falsification subi par le message et ses pi?ces jointes au cours de leur transmission.<br>> Retrouvez toutes les informations de l'ANRT sur son site Web ? l'adresse suivante : <a href="http://www.anrt.ma"
target="_blank">http://www.anrt.ma</a>.<br>><br>> This message, its content and its attachments are intended for the exclusive use of the named addressee (s) and are strictly confidential. Any copy or other use of this information by persons or entities other than the intended recipient is prohibited and should be authorized by the National Agency of Telecommunications Regulation (ANRT, Morocco). If you have received this communication in error, please delete the material and notify the sender. The ANRT accepts no liability for any alteration, distortion or falsification that may occur during the transmission of this message. All information about ANRT can be found on our website at the following address <a href="http://www.anrt.ma" target="_blank">http://www.anrt.ma</a>.<br>><br>> _______________________________________________<br>> afnog mailing list<br>> <a href="http://afnog.org/mailman/listinfo/afnog"
target="_blank">http://afnog.org/mailman/listinfo/afnog</a><br>><br>><br>> <br>-------------- next part --------------<br>A non-text attachment was scrubbed...<br>Name: smime.p7s<br>Type: application/x-pkcs7-signature<br>Size: 3540 bytes<br>Desc: S/MIME Cryptographic Signature<br>Url : <a href="https://lists.afrinic.net/pipermail/africann/attachments/20090518/a9de41dc/smime.bin" target="_blank">https://lists.afrinic.net/pipermail/africann/attachments/20090518/a9de41dc/smime.bin</a><br><br>------------------------------<br><br>_______________________________________________<br>AfrICANN mailing list<br><a ymailto="mailto:AfrICANN@afrinic.net" href="/mc/compose?to=AfrICANN@afrinic.net">AfrICANN@afrinic.net</a><br><a href="https://lists.afrinic.net/mailman/listinfo.cgi/africann" target="_blank">https://lists.afrinic.net/mailman/listinfo.cgi/africann</a><br><br><br>End of AfrICANN Digest, Vol 27, Issue
18<br>****************************************<br></div></blockquote></td></tr></table><br>