Ns.se

By thread

ns.se@lists.iis.se

January 2025

2 participants
2 messages

Påminnelse: DNS Hackathon 2025

by Lars-Johan Liman

Halloj! Jag har sett att flera av er har anmält er till DNS Hackathon här hos oss på Netnod, i samarbete med RIPE NCC och DNS-OARC. Jätteroligt! Jag vill bara påminna om att det blir _ännu_ roligare om ni andra också kommer ... 😉 Glada hälsningar /Liman #---------------------------------------------------------------------- Välkommen till DNS Hackathon 2025 i Stockholm! Netnod, DNS-OARC och RIPE NCC bjuder in dig till vårt andra gemensamma DNS Hackathon den 15–16 mars 2025 på Netnods kontor i Solna, helgen innan Netnod-mötet. Hackathonet samlar deltagare med olika bakgrunder för att utveckla verktyg, idéer och lösningar kring DNS – allt i en kreativ och samarbetande miljö. Viktiga datum: - 15 okt 2024: Ansökan öppnar - 2 feb 2025: Sista deadline - 15–16 mars 2025: Hackathonet Deltagandet är gratis, inklusive mat och dryck. Platserna är begränsade, så ansök idag! Ansök och läs mer här: https://labs.ripe.net/author/becha/join-the-dns-hackathon-2025/ Har du frågor? Kontakta oss på <dnshackathon2025(a)dns-oarc.net>. Välkommen! Johanna Eriksson (Netnod) Denesh Bhabuta (DNS-OARC), Vesna Manojlovic (RIPE NCC) Johanna Eriksson, Event Manager Netnod AB Tel: +46-8-562 860 00, Mobile: +46-70-813 55 62 Greta Garbos väg 13 | SE-169 40 SOLNA | SWEDEN

Jan. 20, 2025

Re: (Jul)ledighet - risk för att "buset" ökar

by Jacob Bunk Nielsen

Hi Frederik "Fredrik Pettai via Ns.se" <ns.se(a)lists.iis.se> writes: >> On 20 Dec 2024, at 08:02, Jacob Bunk Nielsen via Ns.se <ns.se(a)lists.iis.se> wrote: >> >> Do you see any pattern in queries being made that could give you a hint >> about what is going on? E.g. is it towards zones hosted in your DNS >> servers? > > We don’t log queries by default, we only log all issues/errors and > policy decisions. We log a small statistical sample of queries to be able to investigate what we get a lot of. If you can live with the privacy implications, I can highly recommend this for later investigation. >> Which kind of records are they looking for? Are there any patterns in >> the names they query for? > > Real names & words in the zone or subdomain(s) of the zone, as far as > we could see from our manual checks. And the name server stats didn't > show any broken / illegal queries either. Seems like a standard pseudo-random subdomain attack to me. > Since we don’t log queries (for privacy reasons), we can only guess > they were updating a catalog of free domain names. > Perhaps this is more of an issue for TLDs? Only we haven’t seen this before… They would only hit your name servers for domains that are delegated to your servers, right? So looking up stuff like example.sunet.se would only really be useful as part of some form of attack, I believe. We see these sort of attacks regularly. Best regards, Jacob

Jan. 3, 2025