Subject: RE: dictionary attack on nameservers

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 18 Aug 2004 08:00:23 -0700

> > It is pretty clear that whoever is running the .il domain 
> is not going to
> > implement any scheme that makes it easier to walk the domain.
> 
> Can you be more specific about the kind of attacks?
> 
> Most of the attacks I know do not benefit from the knowledge of domain
> names.

The Israeli-Palestinian cyberwar went roughly thus:

Israeli hacker attacks sites operated by Hammas, Hezbollah
Palestinians retaliate
Israeli retaliate
Palestinians retaliate
Israeli hackers attempt retaliation, discover that there are no
	targets left
Palestinians attack every site that they know of which is 
	in the .il domain.

There is a lot of stuff on this on the net. The Israeli hackers
seem to have been a bunch of teenage hackers who did not know
what they were starting, or maybe they did since they now have
a really big line selling security consultancy to the sites
being attacked in retaliation for the sites they attacked.

The bottom line is that any site that comes up in the .il 
domain is going to be attacked as soon as it becomes known.

There are a bunch of other similar events. The incident 
in 2001 when the US and China got into a standoff over a 
spy plane led to a small scale cyberwar but it never got
very far before the situation was resolved.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Florian Weimer <[email-masked]>
Date: Wed, 18 Aug 2004 18:10:46 +0200

> domain is going to be attacked as soon as it becomes known.

And .ps and .il have completely segregated backbone infrastructure, so
that you can safely tell an attack of a .ps site from an attack on an
.il site?

In this case, wouldn't it be easier to go for the infrastructure
itself, and not for specific sites?  Or are we talking about attacks
on the application layer?

(I'm a bit surprised because it's hard to imagine for me that the
infrastructure is so clearly separated.  Unfortunately, I haven't got
enough data on .ps and .il to provide some evidence with respect to
shared hosting.)