[nsp-sec] AS27595 (Intercage) gone - implications..

[White, Gerard]

Greetings.

We're getting some (a few) "slow" reports, and they're basically
customers that have been
changed to use 85.255.112.0 - 85.255.116.255 resolvers.

Oddly enough, the pairings in their configuration ALWAYS includes an
85.255.112.0/24 resolver,
so they're not completely dead.  Just stalling on resolver calls to
85.255.113.0 - 85.255.116.255 ranges (that are not answering right
now...)

GW
855 - Bell Aliant


> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net
[mailto:nsp-security-bounces at puck.nether.net] On Behalf Of
> Huopio Kauto
> Sent: Monday, September 22, 2008 11:05 AM
> To: NSP nsp-security
> Subject: [nsp-sec] AS27595 (Intercage) gone - implications..
> 
> ----------- nsp-security Confidential --------
> 
> Now that AS27595 has no routing, there could be some
> interesting effects to the end users. Those who have
> been infected with dns-changer malware which changes
> DNS resolvers to Intercage addresspace could find
> radical connectivity issues.
> 
> This could cause end users calling your customer support.
> 
> Any other issues that we should observe/follow?
> 
> --Kauto
> 
> Kauto Huopio - kauto.huopio at ficora.fi
> Senior information security adviser
> Finnish Communications Regulatory Authority  / CERT-FI
> tel. +358-9-6966772, fax +358-9-6966515, mobile +358-50-5826131
> CERT-FI watch desk daytime: +358-9-6966510 / http://www.cert.fi
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the
nsp-security
> community. Confidentiality is essential for effective Internet
security counter-measures.
> _______________________________________________