<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV><DIV>From the SANS mailing list:</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Begin forwarded message:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><B>From: </B></FONT><FONT face="Helvetica" size="3" style="font: 12.0px Helvetica">The SANS Institute <<A href="mailto:NewsBites@sans.org">NewsBites@sans.org</A>></FONT></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><B>Date: </B></FONT><FONT face="Helvetica" size="3" style="font: 12.0px Helvetica">September 26, 2006 11:03:40 AM MDT</FONT></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><FONT face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><B>Subject: </B></FONT><FONT face="Helvetica" size="3" style="font: 12.0px Helvetica"><B>SANS NewsBites Vol. 8 Num. 76</B></FONT></DIV></BLOCKQUOTE><DIV>...</DIV><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">ATTACKS, INTRUSIONS, DATA THEFT & LOSS</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><SPAN class="Apple-converted-space"> </SPAN>--DNS Attack in China Takes 180,000 Web Sites Offline</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">(26 September 2006)</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">China's second largest domain name service (DNS) provider, Xinet, was</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">hit with an eight-hour denial of service attack that disabled 180,000</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">web sites.<SPAN class="Apple-converted-space"> </SPAN>Many of the web sites are back on line and Xinet hopes to</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">have the rest (primarily smaller sites) back on line by October 7. The</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Shanghai Daily site on which the attack is reported was one of the ones</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">that had been disabled.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://www.shanghaidaily.com/art/2006/09/22/292743/Attack_confirmed__big_Websites_back_online.htm">http://www.shanghaidaily.com/art/2006/09/22/292743/Attack_confirmed__big_Websites_back_online.htm</A></DIV></BLOCKQUOTE></DIV><BR><DIV>Any knowledge of what occurred? Something more than what is reported in the public press. The only statement is "It is obviously not a simple DDoS attack."</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>The only domain name specifically identified in this article has just two DNS servers operated by Xinnet, both on a single 24 bit CIDR subnet. Xinnet itself lists four servers on one 23-bit CIDR subnet. Doesn't this seem unusual, short sighted, for a large provider of DNS services?</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Bill Larson</DIV></BODY></HTML>