Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-17 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], william( at)elan.net writes: On Sun, 16 Jan 2005, Joe Maimon wrote: Thus justifying those who load their NS and corresponding NS's A records with nice long TTL Although this wasn't a problem in this case (hijacker did not appear to have been interested in

Re: [registrars] Re: panix.com hijacked

2005-01-17 Thread Joe Abley
On 17 Jan 2005, at 13:08, Steven M. Bellovin wrote: The suggestion that someone made the other day -- that the TTL on zones be ramped up gradually by the registries after creation or transfer -- is, I think, a good one. Records in the control of the registry are the NS records in the parent zone

Re: [registrars] Re: panix.com hijacked

2005-01-17 Thread Edward Lewis
At 13:54 -0500 1/17/05, Joe Abley wrote: So the TTLs of records in the registry-operated zones will likely have no impact on how long NS records for delegated zones remain in caches. If panix (or anybody else) wants to increase the time that their NS records stay in caches, the way to do it is to

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-17 Thread Joe Maimon
Steven M. Bellovin wrote: In message [EMAIL PROTECTED], william( at)elan.net writes: On Sun, 16 Jan 2005, Joe Maimon wrote: Thus justifying those who load their NS and corresponding NS's A records with nice long TTL Although this wasn't a problem in this case (hijacker did not

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread William Allen Simpson
Since folks have been working on this for hours, and according to posts on NANOG, both MelbourneIT and Verisign refuse to do anything for days or weeks, would it be a good time to take drastic action? Think of what we'd do about a larger ISP, or the Well, or really any serious financial target.

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Alexei Roudnev
- From: William Allen Simpson [EMAIL PROTECTED] To: nanog@merit.edu Sent: Sunday, January 16, 2005 12:38 AM Subject: Re: panix.com hijacked (VeriSign refuses to help) Since folks have been working on this for hours, and according to posts on NANOG, both MelbourneIT and Verisign refuse to do

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Paul G
- Original Message - From: Alexei Roudnev [EMAIL PROTECTED] To: William Allen Simpson [EMAIL PROTECTED]; nanog@merit.edu Sent: Sunday, January 16, 2005 4:07 AM Subject: Re: panix.com hijacked (VeriSign refuses to help) I addition, there is a good rule for such situations: - first

Re: panix.com hijacked

2005-01-16 Thread Raymond Dijkxhoorn
Hi! So let's see.. the users will see this when they log into shell.panix.net (since shell.panix.com is borked).. Somehow, that doesn't seem to help much.. and the hijackers could be, potentially, running a box pretending to be shell.panix.com, gathering userids and passwds :( Or put up a pop

RE: seed resolvers? Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Scott Morris
Of Petra Zeidler Sent: Sunday, January 16, 2005 6:28 AM To: nanog@merit.edu Subject: seed resolvers? Re: panix.com hijacked (VeriSign refuses to help) Hi, Thus wrote Alexei Roudnev ([EMAIL PROTECTED]): What happen if someone stole 'aol.com'domain tomorrow? Or 'microsoft.com'? How much damage

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Eric Brunner-Williams in Portland Maine
Oki all, Its dawn in Maine, the caffine delivery system has only just started, but I'll comment on the overnight. You're welcome [EMAIL PROTECTED] If you'll send me the cell phone number for the MIT managment I will call wearing my registrar hat and inform whoever I end up speaking with that

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Hank Nussbacher
On Sun, 16 Jan 2005, Eric Brunner-Williams in Portland Maine wrote: One could almost think this hijack was timed to the release of the ICANN Requests Public Comments on Experiences with Inter-Registrar Transfer Policy from Jan 12: http://www.icann.org/announcements/announcement-12jan05.htm

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Alexei Roudnev
I addition, there is a good rule for such situations: - first, return everything to _previous_ state; - having it fixed in previous state, allow time for laywers, disputes and so on to resolve a problem. agreed. but then proverbially, common sense isn't. What happen if someone

fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread Eric Brunner-Williams in Portland Maine
To: Mark Jeftovic [EMAIL PROTECTED] CC: Registrars Constituency [EMAIL PROTECTED] Subject: Re: [registrars] Re: panix.com hijacked References: [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: [EMAIL

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread Lou Katz
Is there anything that us folks out in the peanut gallery can do to help, other than locally serving the panix.net zone for panix.com? -- -=[L]=-

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread Daniel Karrenberg
On 16.01 10:25, Lou Katz wrote: Is there anything that us folks out in the peanut gallery can do to help, other than locally serving the panix.net zone for panix.com? Avoid being caught by an IPR lawyer while helping; ;-) Then organise operators to insert operational clue into the

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread Richard Irving
Don't panic ? ;) Lou Katz wrote: Is there anything that us folks out in the peanut gallery can do to help, other than locally serving the panix.net zone for panix.com?

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread Andrew Brown
On Sun, Jan 16, 2005 at 07:21:55PM +0100, Daniel Karrenberg wrote: On 16.01 12:46, William Allen Simpson wrote: --- Forwarded Message From: Ross Wm. Rader [EMAIL PROTECTED] I don't see what you are looking at - .net and .com point to the same place with no indication of

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread gnulinux
On 16 Jan 2005 at 10:25, Lou Katz wrote: Is there anything that us folks out in the peanut gallery can do to help, other than locally serving the panix.net zone for panix.com? -- -=[L]=- actually this is amazingly helpful. in fact encouraging more ISPs to do the same thing is, IMHO,

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread Joe Maimon
Andrew Brown wrote: On Sun, Jan 16, 2005 at 07:21:55PM +0100, Daniel Karrenberg wrote: On 16.01 12:46, William Allen Simpson wrote: --- Forwarded Message From: Ross Wm. Rader [EMAIL PROTECTED] I don't see what you are looking at - .net and .com point to the same place with no

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-16 Thread Sean Donelan
On Sun, 16 Jan 2005, Alexei Roudnev wrote: What happen if someone stole 'aol.com'domain tomorrow? Or 'microsoft.com'? How much damage will be done until this sleeping behemots wake up, set up a meeting (in Tuesday I believe - because Monday is a holiday), make any decision, open a toicket,

Re: panix.com hijacked

2005-01-16 Thread William Warren
actually godaddy has been quite reponsive for me @ 3am before. Eric Brunner-Williams in Portland Maine wrote: Howdy Perry, Alexis Rosen of Panix was on the phone earlier today with the company attorney for melbourneit -- reputedly he was informed that even if the police called, they would not do

Re: fwd: Re: [registrars] Re: panix.com hijacked

2005-01-16 Thread william(at)elan.net
On Sun, 16 Jan 2005, Joe Maimon wrote: Thus justifying those who load their NS and corresponding NS's A records with nice long TTL Although this wasn't a problem in this case (hijacker did not appear to have been interested in controlling dns since it points to default domain registration

panix.com hijacked

2005-01-15 Thread Steven M. Bellovin
panix.com has apparently been hijacked. It's now associated with a different registrar -- melbourneit instead of dotster -- and a different owner. Can anyone suggest appropriate people to contact to try to get this straightened out? --Prof. Steven M. Bellovin,

Re: panix.com hijacked

2005-01-15 Thread Chris Adams
Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said: panix.com has apparently been hijacked. It's now associated with a different registrar -- melbourneit instead of dotster -- and a different owner. Can anyone suggest appropriate people to contact to try to get this straightened

Re: panix.com hijacked

2005-01-15 Thread Mark Jeftovic
On Sat, 15 Jan 2005, Chris Adams wrote: Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said: panix.com has apparently been hijacked. It's now associated with a different registrar -- melbourneit instead of dotster -- and a different owner. Can anyone suggest appropriate people

Re: panix.com hijacked

2005-01-15 Thread Perry E. Metzger
Mark Jeftovic [EMAIL PROTECTED] writes: Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said: panix.com has apparently been hijacked. It's now associated with a different registrar -- melbourneit instead of dotster -- and a different owner. Can anyone suggest appropriate people

Re: panix.com hijacked

2005-01-15 Thread bmanning
On Sat, Jan 15, 2005 at 10:27:31PM -0500, Steven M. Bellovin wrote: panix.com has apparently been hijacked. It's now associated with a different registrar -- melbourneit instead of dotster -- and a different owner. Can anyone suggest appropriate people to contact to try to get this

Re: panix.com hijacked

2005-01-15 Thread william(at)elan.net
On Sat, 15 Jan 2005, Mark Jeftovic wrote: Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said: panix.com has apparently been hijacked. It's now associated with a different registrar -- melbourneit instead of dotster -- and a different owner. Can anyone suggest appropriate

Re: panix.com hijacked

2005-01-15 Thread Eric Brunner-Williams in Portland Maine
I've forwared to Bruce Tonkin, who I know personally, at MIT, and Cliff Page, who I don't know as well, at Dotster, Steve's note. These are the RC reps for each registrar.

Re: panix.com hijacked

2005-01-15 Thread Chris Adams
Once upon a time, Robert Kryger [EMAIL PROTECTED] said: On Sat, 15 Jan 2005, Chris Adams wrote: Good luck dealing with melbourneit.com; that's the place where domains go to die. Can you be a little more specific? You imply that you have experience or anecdotes about this outfit and this

Re: panix.com hijacked

2005-01-15 Thread Eric Brunner-Williams in Portland Maine
If I were Panix ... Free advice. Bruce, Cliff and Chuck are people. Yes, even Chuck is a people. You want prompt service, you ask nice and you ask the right people and you don't assume there are facts not in evidence, like errors or malfeasence, when you could be solving the problem, before

Re: panix.com hijacked

2005-01-15 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Eric Brunner-Williams in Portland Maine writes: If I were Panix ... Free advice. Bruce, Cliff and Chuck are people. Yes, even Chuck is a people. You want prompt service, you ask nice and you ask the right people and you don't assume there are facts not in

Re: panix.com hijacked

2005-01-15 Thread Perry E. Metzger
Eric Brunner-Williams in Portland Maine [EMAIL PROTECTED] writes: If I were Panix ... Free advice. Bruce, Cliff and Chuck are people. Yes, even Chuck is a people. You want prompt service, you ask nice and you ask the right people and you don't assume there are facts not in evidence, like

Re: panix.com hijacked

2005-01-15 Thread Eric Brunner-Williams in Portland Maine
Howdy Perry, Alexis Rosen of Panix was on the phone earlier today with the company attorney for melbourneit -- reputedly he was informed that even if the police called, they would not do anything about the problem until Monday their time. (a) I don't know MIT's attorney, and (b) I wouldn't

Re: panix.com hijacked

2005-01-15 Thread Mark Jeftovic
On Sat, 15 Jan 2005, Steven M. Bellovin wrote: MelbourneIT needs to demonstrate a proper FOA (Form of Authorization) to have initiated the transfer and if its found to be invalid the domain will be re-instated and Melbourne-IT fined. Thanks. I'm told that dotster says they have no record

Re: panix.com hijacked

2005-01-15 Thread Richard Cox
On Sat, 15 Jan 2005 22:05:47 -0600 Chris Adams [EMAIL PROTECTED] wrote: I do know that we've had hosting customers that have had domains with melbourneit.com as the registrar that they were unable to ever transfer to another registrar (despite emails, faxes, and phone calls; IIRC one

Re: panix.com hijacked

2005-01-15 Thread Valdis . Kletnieks
On Sun, 16 Jan 2005 01:32:46 EST, Henry Yen said: from panix shell hosts motd: . panix.net usable as panix.com (marcotte) Sat Jan 15 10:44:57 2005 So let's see.. the users will see this when they log into shell.panix.net (since shell.panix.com is borked).. Somehow, that doesn't seem to help

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Thor Lancelot Simon
Alexis Rosen tried to send this to NANOG earlier this evening but it looks like it never made it. Apologies if it's a duplicate; we're both reduced to reading the list via the web interface since the legitimate addresses for panix.com have now timed out of most folks' nameservers and been

Re: panix.com hijacked

2005-01-15 Thread Christopher L. Morrow
On Sun, 16 Jan 2005 [EMAIL PROTECTED] wrote: On Sun, 16 Jan 2005 01:32:46 EST, Henry Yen said: from panix shell hosts motd: . panix.net usable as panix.com (marcotte) Sat Jan 15 10:44:57 2005 So let's see.. the users will see this when they log into shell.panix.net (since

Re: panix.com hijacked

2005-01-15 Thread Thor Lancelot Simon
Apologies for what may be another duplicate message, probably with broken threading. This is Alexis Rosen's original posting to this thread; we think the mail chaos caused by the hijacking of panix.com kept it from ever reaching the list (but, flying mostly-blind, we aren't sure). On Sat, Jan

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Thor Lancelot Simon
On Sun, Jan 16, 2005 at 02:22:59AM -0500, Paul G wrote: - Original Message - From: Thor Lancelot Simon [EMAIL PROTECTED] To: nanog@merit.edu Sent: Sunday, January 16, 2005 2:04 AM Subject: Re: panix.com hijacked (VeriSign refuses to help) Alexis Rosen tried to send

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Paul G
- Original Message - From: Thor Lancelot Simon [EMAIL PROTECTED] To: Paul G [EMAIL PROTECTED] Cc: nanog@merit.edu Sent: Sunday, January 16, 2005 2:40 AM Subject: Re: panix.com hijacked (VeriSign refuses to help) --- snip --- I don't know if these are merely isolated attempts