<div dir="ltr">Sorry, ignore my last mail about how it was hacked. Just noticed your previous message:<div><br></div><div><br></div><div><i>"Got the actual fact. The WebFront end of the .BD was compromised. So hacker changed some DNS record via that.</i></div><div><i>At this moment it seems fixed. " </i></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>Thanks for info Sumon! </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 21, 2016 at 3:39 PM, Anurag Bhatia <span dir="ltr"><<a href="mailto:me@anuragbhatia.com" target="_blank">me@anuragbhatia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Sumon<div><br></div><div><br></div><div>Was wondering if it's known on how delegation was changed? Was it some vulnerability in exposed APIs or someone managed to do it right on master server? </div><div><br></div><div><br></div><div>On an unrelated note: It seems like PCH's <a href="http://bd-ns.anycast.pch.net" target="_blank">bd-ns.anycast.pch.net</a>. is still not published on the root servers and this will impact if existing three <i>(which all happen to be in bd)</i> have any issues. In current scenario recursors will cache NS records from existing three auth which includes 4th auth of PCH. Thus the presence of PCH's auth in NS records will help only if at least one of three others stays available else fresh query will just fail because of missing delegation to PCH on the parent (root zone). </div><div><br></div><div><br></div><div><br></div><div><br></div><div><div><font size="1" face="monospace, monospace">dig @<a href="http://i.root-servers.net" target="_blank">i.root-servers.net</a>. bd. ns +auth</font></div><div><font size="1" face="monospace, monospace"><br></font></div><div><font size="1" face="monospace, monospace">; <<>> DiG 9.8.3-P1 <<>> @<a href="http://i.root-servers.net" target="_blank">i.root-servers.net</a>. bd. ns +auth</font></div><div><font size="1" face="monospace, monospace">; (2 servers found)</font></div><span class=""><div><font size="1" face="monospace, monospace">;; global options: +cmd</font></div><div><font size="1" face="monospace, monospace">;; Got answer:</font></div></span><div><font size="1" face="monospace, monospace">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29491</font></div><div><font size="1" face="monospace, monospace">;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 3</font></div><span class=""><div><font size="1" face="monospace, monospace">;; WARNING: recursion requested but not available</font></div><div><font size="1" face="monospace, monospace"><br></font></div></span><div><font size="1" face="monospace, monospace">;; QUESTION SECTION:</font></div><div><font size="1" face="monospace, monospace">;bd.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>NS</font></div><div><font size="1" face="monospace, monospace"><br></font></div><div><font size="1" face="monospace, monospace">;; AUTHORITY SECTION:</font></div><div><font size="1" face="monospace, monospace" style="background-color:rgb(255,255,0)">bd.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>172800<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>NS<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="http://surma.btcl.net.bd" target="_blank">surma.btcl.net.bd</a>.</font></div><div><font size="1" face="monospace, monospace" style="background-color:rgb(255,255,0)">bd.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>172800<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>NS<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="http://dns.bd" target="_blank">dns.bd</a>.</font></div><div><font size="1" face="monospace, monospace" style="background-color:rgb(255,255,0)">bd.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>172800<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>NS<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="http://jamuna.btcl.net.bd" target="_blank">jamuna.btcl.net.bd</a>.</font></div><span class=""><div><font size="1" face="monospace, monospace"><br></font></div><div><font size="1" face="monospace, monospace">;; ADDITIONAL SECTION:</font></div><div><font size="1" face="monospace, monospace"><a href="http://dns.bd" target="_blank">dns.bd</a>.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>172800<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>A<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>209.58.24.3</font></div><div><font size="1" face="monospace, monospace"><a href="http://surma.btcl.net.bd" target="_blank">surma.btcl.net.bd</a>.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>172800<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>A<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>203.112.194.232</font></div><div><font size="1" face="monospace, monospace"><a href="http://jamuna.btcl.net.bd" target="_blank">jamuna.btcl.net.bd</a>.<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>172800<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>IN<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>A<span class="m_5835381760818303180gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>203.112.194.231</font></div><div><font size="1" face="monospace, monospace"><br></font></div></span><div><font size="1" face="monospace, monospace">;; Query time: 295 msec</font></div><div><font size="1" face="monospace, monospace">;; SERVER: 2001:7fe::53#53(2001:7fe::53)</font></div><div><font size="1" face="monospace, monospace">;; WHEN: Wed Dec 21 15:34:48 2016</font></div><div><font size="1" face="monospace, monospace">;; MSG SIZE rcvd: 136</font></div></div><div><font size="1" face="monospace, monospace"><br></font></div><div><font size="1" face="monospace, monospace"><br></font></div><br>Thanks</div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Wed, Dec 21, 2016 at 3:54 AM, Sumon Ahmed Sabir <span dir="ltr"><<a href="mailto:sumon@fiberathome.net" target="_blank">sumon@fiberathome.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div>Yes Donald.</div><div><br></div><div>I can see that the .BD ccTLD is normal for last 12 hours. Hope it remains so.</div><div><br></div><div>Signing root zone is overdue for long time. Lets see if we can push it forward with this incident....</div><div>Singing the root zone and also some capacity building to maintain it properly. </div><div><br></div><div>In fact still they are not ready or capable to maintain DNSSEC.</div><span class="m_5835381760818303180HOEnZb"><font color="#888888"><div><br></div><div>-sumon</div></font></span></div><br><div class="gmail_quote"><div><div class="m_5835381760818303180h5"><div dir="ltr">On Tue, 20 Dec 2016 at 21:48 Donald Clark <<a href="mailto:dsc@google.com" target="_blank">dsc@google.com</a>> wrote:<br></div></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_5835381760818303180h5"><div dir="ltr" class="m_5835381760818303180m_-2062311419483634441gmail_msg"><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg">Hi all</div><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg"><br class="m_5835381760818303180m_-2062311419483634441gmail_msg"></div><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg">Thanks for sharing all this on BDNOG list. Can some of you out there confirm that this .bd ccTLD is now behaving correctly again?</div><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg"><br class="m_5835381760818303180m_-2062311419483634441gmail_msg"></div><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg">Not a whole lot we can do if a ccTLD has been impacted.</div><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg"><br class="m_5835381760818303180m_-2062311419483634441gmail_msg"></div><div class="gmail_extra m_5835381760818303180m_-2062311419483634441gmail_msg">Time for signing the root zone?</div></div></div></div><span>
______________________________<wbr>_________________<br class="m_5835381760818303180m_-2062311419483634441gmail_msg">
nog mailing list<br class="m_5835381760818303180m_-2062311419483634441gmail_msg">
<a href="mailto:nog@bdnog.org" class="m_5835381760818303180m_-2062311419483634441gmail_msg" target="_blank">nog@bdnog.org</a><br class="m_5835381760818303180m_-2062311419483634441gmail_msg">
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" rel="noreferrer" class="m_5835381760818303180m_-2062311419483634441gmail_msg" target="_blank">http://mailman.bdnog.org/mailm<wbr>an/listinfo/nog</a><br class="m_5835381760818303180m_-2062311419483634441gmail_msg">
</span></blockquote></div>
<br>______________________________<wbr>_________________<br>
nog mailing list<br>
<a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" rel="noreferrer" target="_blank">http://mailman.bdnog.org/mailm<wbr>an/listinfo/nog</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div class="m_5835381760818303180gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div><font face="arial, helvetica, sans-serif"><br></font></div><div><br></div><font face="arial, helvetica, sans-serif">Anurag Bhatia<br></font><div></div><div><font face="arial, helvetica, sans-serif"><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></font></div></div></div></div></div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div><font face="arial, helvetica, sans-serif"><br></font></div><div><br></div><font face="arial, helvetica, sans-serif">Anurag Bhatia<br></font><div></div><div><font face="arial, helvetica, sans-serif"><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></font></div></div></div></div></div></div>
</div>