Re: Real world DNS poisonings and consequences

In the late 90s Eugene Kashpureff set up some A records for internet.net
so when somebody send mail to him and looked up the MX record for his alternic.net
they got the wrong A records for internic.net which he'd pointed to alternic.net
so when you typed in http://internic.net you were taken to Alternic. In other
words he's hijacked the Internic. As you might imagine, the usual cast
of characters went ballistic, and that's putting it mildly.

Note the mail and www.internic.net were unaffected.

This landed him on both Canadian and American prisons when the FBI
finally found him and on TV on the CBC show "Undercurrents" with
Wendy Mesli. I'm sorta on that show too; I was working with him
previously but I'd had enough of THAT about 6 weeks before he pulled this
stunt and didn't know he'd done it till he did. He didn't tell anybody
before he did it.

This killed the alternative root server movement and "legitimized"
(the need for) icann. It was a stain we could never get rid of. Alternic
had about 3-4% penetration until that day - then it went to zero overnight
and never recovered. All subsequent efforts failed mostly because of this
disaster.

Pretty much nobody has talked to Eugene since then. Dumbest thing ever.

Eugene got off light and as part of the settlement he had to explain to
Mark Kosters at NSI what he'd done and how.

Note that only BIND was susceptible to this. djb was of course unaffected
because it rejects out of balliwick answers.


At 12:13 AM 10/30/2010 +0200, [email protected] wrote:
>Hey folks,
>
>Do you guys know of any [documented] real case of DNS cache poisoning?
>
>There are a lot of boring technical documents about the flaws of DNS,  
>but I don't find much about the real damages it did actually make (in  
>terms of money let's say).
>
>If you have any reference please let me know.
>
>Kind regards,
>  Dinesh
>
>
--
Richard J. Sexton  [email protected]  +1 (206) 333-1798 skype: rsx11s
http://rs79.vrx.net http://mbz.org http://killi.net http://aquaria.net