-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Good Evening All, I thought it would be good to let you know that CCIP is aware of this vulnerability and has been working on it behind the scenes with the international community since May. In early July CCIP met with NZ Registry Services to discuss this issue and determine who the most appropriate audience for this information would be. Because of the sensitivity of this it was determined that the NZNOG mailing list would not be appropriate as it is an open forum with over 800 registered participants. It was agreed that the best method would be to send this out to the ISPANZ members. CCIP also issued an embargoed release to some of the larger ISP's prior to the public release. CCIP regularly work very closely with the international CERT community to coordinate on the dissemination of information such as this and we have been working a lot over the last few weeks to coordinate on this particular release. CCIP had the release prepared to send out the morning that it was made public. This was a report that had been prepared in conjunction with the international CERT community. While it may appear that CCIP or other CERTs reporting is just simply re-badged products from another country it has often has been worked on collaboratively prior to the release. This is to ensure that clear and consistent messages are being issued by all countries. CCIP is hosting an international meeting here later in the year where a key item on the agenda is this specific event. There will be a review of this collaborative effort and where it worked well and where there is room for improvement. CCIP has identified that in New Zealand there is a need for a stronger relationship between CCIP and the NZ ISP community and developing those relationships is going to be an ongoing process. If you have any details of vulnerable DNS servers in New Zealand please do not hesitate to send these through to incidents(a)ccip.govt.nz. There have been some already sent through today from members of this list and those have been or are being addressed by the relevant ISP's and thank you for sending those through. If you would like to introduce yourself to CCIP and/or to arrange a time to come in to meet with CCIP please feel free to contact CCIP at (info(a)ccip.govt.nz). Regards, Paul. - -- Paul McKitrick Business Manager Centre for Critical Infrastructure Protection P: (+64) 4 498 7654 F: (+64) 4 498 7655 E: paul.mckitrick(a)ccip.govt.nz W: www.ccip.govt.nz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBSIlzyDpQQM+EFUs7AQKLqwgAyfn/HPnxWW3MQvyt6nPHQJwkTIk8slpK 0SoclMnIoyX7HxJhjFF8z369Bfece1xg/3kUE4D2d693lVv1Aih6LUIf/BrprppF iJJmZCXbf3n3y2ZSLembf+vDj/Ff1/JYFECDKLsJNjDESTd2i2X6EgeZGMXeR41p cwKVUoyrmWbdmBcsxHkwAjy8KBwBBIBzBiwkW7tKd9Ed5RhoIlVrkmWgrJrdvMDf aF28UUUP2aYRisHrZJnTwkw1Z3ghFp12emNj2EMJons0ZLPKLhV1vt573eeyqFYH deQ6BbYNqpzvNrqVewSE07kBY2t8SDf3wFs8sI+VoPinAV8HGyvUvg== =NmEG -----END PGP SIGNATURE----- --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---
Paul and all, Good! Thanks for the update/info! >:) Paul McKitrick wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Good Evening All,
I thought it would be good to let you know that CCIP is aware of this vulnerability and has been working on it behind the scenes with the international community since May.
In early July CCIP met with NZ Registry Services to discuss this issue and determine who the most appropriate audience for this information would be. Because of the sensitivity of this it was determined that the NZNOG mailing list would not be appropriate as it is an open forum with over 800 registered participants. It was agreed that the best method would be to send this out to the ISPANZ members.
CCIP also issued an embargoed release to some of the larger ISP's prior to the public release.
CCIP regularly work very closely with the international CERT community to coordinate on the dissemination of information such as this and we have been working a lot over the last few weeks to coordinate on this particular release.
CCIP had the release prepared to send out the morning that it was made public. This was a report that had been prepared in conjunction with the international CERT community. While it may appear that CCIP or other CERTs reporting is just simply re-badged products from another country it has often has been worked on collaboratively prior to the release. This is to ensure that clear and consistent messages are being issued by all countries.
CCIP is hosting an international meeting here later in the year where a key item on the agenda is this specific event. There will be a review of this collaborative effort and where it worked well and where there is room for improvement.
CCIP has identified that in New Zealand there is a need for a stronger relationship between CCIP and the NZ ISP community and developing those relationships is going to be an ongoing process.
If you have any details of vulnerable DNS servers in New Zealand please do not hesitate to send these through to incidents(a)ccip.govt.nz. There have been some already sent through today from members of this list and those have been or are being addressed by the relevant ISP's and thank you for sending those through.
If you would like to introduce yourself to CCIP and/or to arrange a time to come in to meet with CCIP please feel free to contact CCIP at (info(a)ccip.govt.nz).
Regards, Paul.
- -- Paul McKitrick Business Manager Centre for Critical Infrastructure Protection P: (+64) 4 498 7654 F: (+64) 4 498 7655 E: paul.mckitrick(a)ccip.govt.nz W: www.ccip.govt.nz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iQEVAwUBSIlzyDpQQM+EFUs7AQKLqwgAyfn/HPnxWW3MQvyt6nPHQJwkTIk8slpK 0SoclMnIoyX7HxJhjFF8z369Bfece1xg/3kUE4D2d693lVv1Aih6LUIf/BrprppF iJJmZCXbf3n3y2ZSLembf+vDj/Ff1/JYFECDKLsJNjDESTd2i2X6EgeZGMXeR41p cwKVUoyrmWbdmBcsxHkwAjy8KBwBBIBzBiwkW7tKd9Ed5RhoIlVrkmWgrJrdvMDf aF28UUUP2aYRisHrZJnTwkw1Z3ghFp12emNj2EMJons0ZLPKLhV1vt573eeyqFYH deQ6BbYNqpzvNrqVewSE07kBY2t8SDf3wFs8sI+VoPinAV8HGyvUvg== =NmEG -----END PGP SIGNATURE-----
--- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---
_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827
On 25 Jul 2008, at 02:33, Paul McKitrick wrote:
In early July CCIP met with NZ Registry Services to discuss this issue and determine who the most appropriate audience for this information would be. Because of the sensitivity of this it was determined that the NZNOG mailing list would not be appropriate as it is an open forum with over 800 registered participants.
For my money, at that time, that would have made NZNOG an ideal place to start making noise about the problem. http://www.kb.cert.org/vuls/id/800113 was published on 7 July. Keeping things quiet after that date seems like quite the wrong thing. What would have been much better would have been a concerted and noisy public airing of the problem, carried out by people who understood it and knew how to answer the (understandably) doubtful responses to it ("isn't this the same thing that was first announced in 2002?", etc.) Joe
On 26/07/2008, at 1:58 AM, Joe Abley wrote:
On 25 Jul 2008, at 02:33, Paul McKitrick wrote:
In early July CCIP met with NZ Registry Services to discuss this issue and determine who the most appropriate audience for this information would be. Because of the sensitivity of this it was determined that the NZNOG mailing list would not be appropriate as it is an open forum with over 800 registered participants.
For my money, at that time, that would have made NZNOG an ideal place to start making noise about the problem.
http://www.kb.cert.org/vuls/id/800113 was published on 7 July. Keeping things quiet after that date seems like quite the wrong thing. What would have been much better would have been a concerted and noisy public airing of the problem, carried out by people who understood it and knew how to answer the (understandably) doubtful responses to it ("isn't this the same thing that was first announced in 2002?", etc.)
Ah, I had "go find a timeline for this DNS thing and reply to NZNOG" on my to do list for tonight. My response was going to be much the same as Joe's - once this stuff is published in a security forum, those who would use it maliciously probably already know, and those who need to do something to patch this probably don't. -- Nathan Ward
Good Evening Everyone, I have to agree with Joe's post and I have also had a number of other off post emails reiterating the same message. Once this had gone public CCIP should have engaged this forum. CCIP has well defined procedures and processes in place when sharing information with the National and International security communities and the "traditional" critical infrastructure community. Outside of those communities the process is not as well defined and this event has highlighted this. What this event has also demonstrated is that the NZNOG community is dedicated to protecting New Zealand's networks and we just need to figure out how we can do that together, and part of that is ensuring the right information gets to the right people. One of the recent suggestions CCIP has received is the concept of establishing an NSP-SEC group for New Zealand. Another suggestion is the need for a closed mailing list for the NZ ISP community. The intention would not be to replace the NZNOG mailing list but to have an alternative for when the community needed a closed and trusted mode of communication. CCIP would like to work with this community to investigate establishing something along these lines in New Zealand and to listen to your thoughts and suggestions on this topic as a number of you have been thinking about this for some time as well. CCIP would like to thank you all for your comments and suggestions both on and off the list, and I look forward to working closer with this community. Regards, Paul. Paul McKitrick Business Manager Centre for Critical Infrastructure Protection D: (+64) 4 498 7675 P: (+64) 4 498 7654 M:(+64) 2 145 4604 F: (+64) 4 498 7655 E: paul.mckitrick(a)ccip.govt.nz W: www.ccip.govt.nz This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. -----Original Message----- From: Joe Abley [mailto:jabley(a)ca.afilias.info] Sent: Saturday, 26 July 2008 1:59 a.m. To: Paul McKitrick Cc: NZNOG(a)list.waikato.ac.nz Subject: Re: [nznog] DNS Cache Poisoning On 25 Jul 2008, at 02:33, Paul McKitrick wrote:
In early July CCIP met with NZ Registry Services to discuss this issue and determine who the most appropriate audience for this information would be. Because of the sensitivity of this it was determined that the NZNOG mailing list would not be appropriate as it is an open forum with over 800 registered participants.
For my money, at that time, that would have made NZNOG an ideal place to start making noise about the problem. http://www.kb.cert.org/vuls/id/800113 was published on 7 July. Keeping things quiet after that date seems like quite the wrong thing. What would have been much better would have been a concerted and noisy public airing of the problem, carried out by people who understood it and knew how to answer the (understandably) doubtful responses to it ("isn't this the same thing that was first announced in 2002?", etc.) Joe
participants (4)
-
Jeffrey A. Williams -
Joe Abley -
Nathan Ward -
Paul McKitrick