[nsp-sec] dnsrooted.com

[Borja Marcos]

> 
> Admin Name: Carlos Diaz
> Admin Organization: TTL expired
> Admin Street: Madrid
> Admin City: Madrid
> Admin State/Province: Madrid
> Admin Postal Code: 28005
> Admin Country: Spain
> Admin Phone: +34.644266224
> Admin Fax:
> Admin Email: ttlexpired at hotmail.com

Doing a Google search I have found a Rootedcon 2012 slide set from a Carlos Diaz and Francisco Jesus Gomez about DNS as a covert channel for botnets.

In the last slide you can see a mention to one of them using the nickname "ttlexpired".

The talk title was "CMD: look who's talking too. DNS: a botnet dialect"

They seem to be employees of Telefonica I+D (tid.es), the R&D division of Telefonica. 

I have Friends in Telefonica, maybe they can find out.




Borja.