spamblocker turns into mail denial of service

[Dana Hudes]

At some point in the last 24 hours the dns-based blackhole list
proxies.relays.monkies.com turned into a deny-all-mail: the A record
for the blackhole list is now 127.0.0.2 which means all mail is rejected.
Anyone who knows anyone who was using this should immediately remove
it. I do not know why the folks at infinite monkeys would do this nasty
thing, perhaps it was done by a spammer hacking in.

Certainly it points out that all such services should be using DNSSEC
and that perhaps that's not enough if the name server is hacked.

[Chris Fuhrman]

--=-nL4/GA3ZyBltAm9LSRas
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Howdy,

The Monkeys.com blacklist was officially retired 9/22 due to repeated
DDoS attacks on it's main servers.

Please see http://www.dnsbl.info/forums/topic.asp?TOPIC_ID=3D12 for the
official closing announcement from Ron Guilmette.

Cheers!

On Mon, 2004-03-15 at 11:21, Dana Hudes wrote:
> At some point in the last 24 hours the dns-based blackhole list
> proxies.relays.monkies.com turned into a deny-all-mail: the A record
> for the blackhole list is now 127.0.0.2 which means all mail is rejected.
> Anyone who knows anyone who was using this should immediately remove
> it. I do not know why the folks at infinite monkeys would do this nasty
> thing, perhaps it was done by a spammer hacking in.
>=20
> Certainly it points out that all such services should be using DNSSEC
> and that perhaps that's not enough if the name server is hacked.
--=20
Chris Fuhrman | Twenty First Century Communications
chris.fuhrman@tfcci.com | Senior Software Engineer
(W) 614-442-1215 x271 |
(F) 614-442-5662 | PGP/GPG Public Key Available on Request


--=-nL4/GA3ZyBltAm9LSRas
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQBAVeu4+PkFQScv4oURAqmnAJ47GueOF7i3bbDKsNGglF AuFmUo1ACgsiKk
14nPl9Xggmpy+JC42bhRLc0=
=Zq1p
-----END PGP SIGNATURE-----

--=-nL4/GA3ZyBltAm9LSRas--

[James]

chris.fuhrman@tfcci.com (Chris Fuhrman) wrote in message news:<c3522s$1oql$1@FreeBSD.csie.NCTU.edu.tw>...
> --=-nL4/GA3ZyBltAm9LSRas
> Content-Type: text/plain
> Content-Transfer-Encoding: quoted-printable
>
> Howdy,
>
> The Monkeys.com blacklist was officially retired 9/22 due to repeated
> DDoS attacks on it's main servers.
>
> Please see http://www.dnsbl.info/forums/topic.asp?TOPIC_ID=3D12 for the
> official closing announcement from Ron Guilmette.
>
> Cheers!
>
> On Mon, 2004-03-15 at 11:21, Dana Hudes wrote:
> > At some point in the last 24 hours the dns-based blackhole list
> > proxies.relays.monkies.com turned into a deny-all-mail: the A record
> > for the blackhole list is now 127.0.0.2 which means all mail is rejected.
> > Anyone who knows anyone who was using this should immediately remove
> > it. I do not know why the folks at infinite monkeys would do this nasty
> > thing, perhaps it was done by a spammer hacking in.
> >=20
> > Certainly it points out that all such services should be using DNSSEC
> > and that perhaps that's not enough if the name server is hacked.
> --=20
> Chris Fuhrman | Twenty First Century Communications
> chris.fuhrman@tfcci.com | Senior Software Engineer
> (W) 614-442-1215 x271 |
> (F) 614-442-5662 | PGP/GPG Public Key Available on Request
>
>
> --=-nL4/GA3ZyBltAm9LSRas
> Content-Type: application/pgp-signature; name=signature.asc
> Content-Description: This is a digitally signed message part
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQBAVeu4+PkFQScv4oURAqmnAJ47GueOF7i3bbDKsNGglF AuFmUo1ACgsiKk
> 14nPl9Xggmpy+JC42bhRLc0=
> =Zq1p
> -----END PGP SIGNATURE-----
>
> --=-nL4/GA3ZyBltAm9LSRas--

Glad I'm not the only IT guy on the planet who noticed this.
The first message I rx'd that was tagged as on the infinite monkey
dnsbl was at 03:00 EST (GMT-5) today, since then all incoming email
has been tagged as spam.

I removed the infinite monkeys DNSBL from my config and we are back to
normal.

I should have done this back in Sept last year.

Thanks for confirming my suspicions

James