[Skunkworks] Sloppy DNS system administration

7 Feb 2012

      Come on guys, an old and fuzzy techie like me shouldn't be finding these
kind of things.

One of Kenyaweb's IP address blocks still has the old company information
(Form-Net) and the information MD (who left the company in 1998) and
Technical Manager (who left in 1996)

Very sloppy people - hope someone addresses this....

This is probably why the Indonesian hacker found it so easy to get into the
server - and by the way, ict.go.ke site has been inaccessibly slow for past
hour, and I understand Gov is paying Kenyaweb about Kshs 36m a year for
this kind of hosting?

inetnum:        194.201.253.0 - 194.201.253.255
<https://apps.db.ripe.net/whois/lookup/ripe/inetnum/194.201.253.0-194.201.253.255.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
netname:        FORMNET
descr:          Form-Net Africa, Kenya
country:        KE
admin-c:        YN5-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/person-role/YN5-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
tech-c:         AG105-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/person-role/AG105-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
status:         ASSIGNED PA
mnt-by:         AS1849-MNT
<https://apps.db.ripe.net/whois/lookup/ripe/mntner/AS1849-MNT.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
source:         RIPE #Filtered

irt:            IRT-MCI-GB
<https://apps.db.ripe.net/whois/lookup/ripe/irt/IRT-MCI-GB.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
address:        ISG/IP Network Security
address:        MCI
address:        Reading International Business Park
address:        Basingstoke Road
address:        Reading
address:        Berkshire
address:        RG2 6DA
address:        GB
phone:          +44 118 905 6094
fax-no:         +44 118 905 5038
abuse-mailbox:  abuse@uk.verizonbusiness.com
org:            ORG-UA24-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/organisation/ORG-UA24-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
admin-c:        WERT1-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/person-role/WERT1-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
tech-c:         WERT1-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/person-role/WERT1-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
auth:           MD5-PW $1$aEyFevLd$QGJ6onxfBWDr/ezQePDYF/
auth:           PGPKEY-5960220D
<https://apps.db.ripe.net/whois/lookup/ripe/key-cert/PGPKEY-5960220D.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
auth:           PGPKEY-5E478DDC
<https://apps.db.ripe.net/whois/lookup/ripe/key-cert/PGPKEY-5E478DDC.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
auth:           PGPKEY-92479A5D
<https://apps.db.ripe.net/whois/lookup/ripe/key-cert/PGPKEY-92479A5D.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
auth:           PGPKEY-B4826395
<https://apps.db.ripe.net/whois/lookup/ripe/key-cert/PGPKEY-B4826395.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
irt-nfy:        ip-net-sec@de.mci.com
irt-nfy:        registrar@eu.uu.net
mnt-by:         MCI-EMEA-M-MNT
<https://apps.db.ripe.net/whois/lookup/ripe/mntner/MCI-EMEA-M-MNT.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
source:         RIPE #Filtered

person:         Yazim Nanji
address:        Form-Net Africa
address:        P.O. Box 41932
address:        Nairobi
address:        Kenya
phone:          +254 2 245630
fax-no:         +254 2 240870
nic-hdl:        YN5-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/person/YN5-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
mnt-by:         AS1849-MNT
<https://apps.db.ripe.net/whois/lookup/ripe/mntner/AS1849-MNT.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
source:         RIPE #Filtered

person:         Alesandro Gonzalez
address:        Form-Net Africa
address:        P.O. Box 41932
address:        Nairobi
address:        Kenya
phone:          +2542 245630
fax-no:         +2542 240870
nic-hdl:        AG105-RIPE
<https://apps.db.ripe.net/whois/lookup/ripe/person/AG105-RIPE.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
mnt-by:         AS1849-MNT
<https://apps.db.ripe.net/whois/lookup/ripe/mntner/AS1849-MNT.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
source:         RIPE #Filtered

Update<https://apps.db.ripe.net/webupdates/;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4?source=RIPE_NCC&type=ROUTE&pkey=194.200.0.0%2F14%2FAS1849&operation=edit-field>
Delete<https://apps.db.ripe.net/webupdates/;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4?source=RIPE_NCC&type=ROUTE&pkey=194.200.0.0%2F14%2FAS1849&operation=delete>

route:          194.200.0.0/14
<https://apps.db.ripe.net/whois/lookup/ripe/route/194.200.0.0/14AS1849.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
descr:          PIPEX-BLOCK4-7
origin:         AS1849
<https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS1849.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
holes:          194.201.253.0/24, 194.202.0.0/22, 194.202.4.0/23,
194.203.46.0/24, 194.203.192.0/23, 194.203.194.0/24, 194.203.247.0/24
remarks:        UUNET UK filter inbound on prefixes longer than /24
remarks:        Please send abuse notification to abuse@uk.uu.net
mnt-by:         AS1849-MNT
<https://apps.db.ripe.net/whois/lookup/ripe/mntner/AS1849-MNT.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
mnt-by:         WCOM-EMEA-RICE-MNT
<https://apps.db.ripe.net/whois/lookup/ripe/mntner/WCOM-EMEA-RICE-MNT.html;jsessionid=34C5ECFB51D2032C092B12FD6CA712E7.apps4>
source:         RIPE #Filtered

-- 
Brian Munyao Longwe
e-mail: blongwe@gmail.com
cell:  +254715964281
blog : http://zinjlog.blogspot.com
meta-blog: http://mashilingi.blogspot.com