On Tue, Apr 21, 2009 at 12:25 PM, Steve Holdoway wrote:

On Tue, 21 Apr 2009 12:14:05 +1200 Michael Jager wrote:

...

So, I wouldn't normally make a post like this, but I figure one or two people might notice this at some point in the next day or so:

mj(a)coalface:~$ whois msn.co.nz | egrep ^ns_name ns_name_01: fatih1.turkguvenligi.info ns_name_02: fatih2.turkguvenligi.info

mj(a)coalface:~$ whois msn.co.nz | egrep ^domain_datelastmodified domain_datelastmodified: 2009-04-21T09:44:21+12:00

From my resolver's cache:

;; ANSWER SECTION: msn.co.nz. 3282 IN A 202.58.48.29

;; AUTHORITY SECTION: msn.co.nz. 20363 IN NS ns4.msft.net. msn.co.nz. 20363 IN NS ns5.msft.net. msn.co.nz. 20363 IN NS ns1.msft.net. msn.co.nz. 20363 IN NS ns2.msft.net. msn.co.nz. 20363 IN NS ns3.msft.net.

;; ADDITIONAL SECTION: ns1.msft.net. 1571 IN A 207.68.160.190 ns2.msft.net. 1593 IN A 65.54.240.126 ns3.msft.net. 18367 IN A 213.199.161.77 ns4.msft.net. 18367 IN A 207.46.66.126 ns5.msft.net. 1302 IN A 65.55.238.126

From the new NS:

;; ANSWER SECTION: msn.co.nz. 14400 IN A 95.211.11.163

;; AUTHORITY SECTION: msn.co.nz. 86400 IN NS fatih1.turkguvenligi.info. msn.co.nz. 86400 IN NS fatih2.turkguvenligi.info.

;; ADDITIONAL SECTION: fatih1.turkguvenligi.info. 14400 IN A 95.211.11.163 fatih2.turkguvenligi.info. 14400 IN A 95.211.11.163

It's not still April Fools, is it?

-Mike _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

Hur...

"Microsoft New Zealand Hacked by Peace Crew"

-- Steve Holdoway http://www.greengecko.co.nz _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

nice.

Quote from Domainz website "We have experienced some technical issues today that have impacted our website" - and resutled in a number of our customers getting pwned. Simple SQL injection bug -> http://zone-h.org/news/id/4708

Some press coverage of this incident:

http://www.nbr.co.nz/article/microsoft-nz-hacked-updated-101421

http://www.zdnet.com.au/news/security/soa/Hackers-deface-New-Zealand-sites/0...

On Tue, Apr 21, 2009 at 12:14 PM, Michael Jager

wrote:

...

;; ADDITIONAL SECTION: fatih1.turkguvenligi.info. 14400 IN A 95.211.11.163 fatih2.turkguvenligi.info. 14400 IN A 95.211.11.163

It's not still April Fools, is it?

-Mike

Cheers, Blair