zone transfer denied

RandomTroll · 09-17-2015, 07:45 PM

Some hackers got through to our server with the 'viagra' virus recently. Inspecting the logs I have found hundreds of errors of this kind:

Quote:

Sep 13 12:23:20 ourdomain named[17503]: client 137.226.113.4#55178: view external: zone transfer 'ourdomain.org/AXFR/IN' denied

I guess they're trying to hijack our name server. They don't seem to have succeeded.

dijetlo · 09-18-2015, 10:15 AM

It looks to me more like they've tried to exfiltrate your private DNS zones and failed due to a lack of rights.
I'd check the logs to see if any zone transfers did occur during exposure and if so, to whom.

RandomTroll · 09-19-2015, 01:27 PM

Quote:

Originally Posted by dijetlo

It looks to me more like they've tried to exfiltrate your private DNS zones

I think that's what I meant when I wrote 'hijack' - or do I misunderstand?

Quote:

Originally Posted by dijetlo

I'd check the logs to see if any zone transfers did occur during exposure and if so, to whom.

I see nothing but failures, but they've tried hundreds of times, apparently from different IPs. I checked out a few of them; 1 was from the University of Aachen, which, I hope, they've either spoofed or hijacked.

dijetlo · 09-22-2015, 08:53 AM

Quote:

that's what I meant when I wrote 'hijack'

Sorry for any confusion, unauthorized zone transfer requests are often part of DNS spoofing exploits, you are correct.