I think someone hijacked NYTimes dns... http://www.chicagotribune.com/business/technology/chi-new-york-times-website... Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37 ~~~ dig any nytimes.com ; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2 ;; QUESTION SECTION: ;nytimes.com. IN ANY ;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com. ;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37
Confirmed hijacked, but I see different results… $ dig any nytimes.com ; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9289 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;nytimes.com. IN ANY ;; ANSWER SECTION: nytimes.com. 86400 IN SOA ns5.boxsecured.com. ssuliman.hotmail.co.uk. 2013082703 86400 7200 3600000 86400 nytimes.com. 14400 IN MX 0 nytimes.com. nytimes.com. 14356 IN A 212.1.211.121 nytimes.com. 86400 IN NS ns5.boxsecured.com. nytimes.com. 86400 IN NS ns6.boxsecured.com. ;; AUTHORITY SECTION: nytimes.com. 86400 IN NS ns6.boxsecured.com. nytimes.com. 86400 IN NS ns5.boxsecured.com. ;; ADDITIONAL SECTION: nytimes.com. 14356 IN A 212.1.211.121 ;; Query time: 93 msec ;; SERVER: 10.10.10.19#53(10.10.10.19) ;; WHEN: Tue Aug 27 14:17:37 2013 ;; MSG SIZE rcvd: 210 On Aug 27, 2013, at 2:09 PM, Grant Ridder <shortdudey123@gmail.com> wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37 _______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
It's been all over the news for hours; yes, it's happening, yes, it appears to be the Syrian Electronic Army that started it, not clear what the status is now (things are bouncing somewhat). On Tue, Aug 27, 2013 at 2:18 PM, John Kinsella <jlk@thrashyour.com> wrote:
Confirmed hijacked, but I see different results…
$ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9289 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 86400 IN SOA ns5.boxsecured.com. ssuliman.hotmail.co.uk. 2013082703 86400 7200 3600000 86400 nytimes.com. 14400 IN MX 0 nytimes.com. nytimes.com. 14356 IN A 212.1.211.121 nytimes.com. 86400 IN NS ns5.boxsecured.com. nytimes.com. 86400 IN NS ns6.boxsecured.com.
;; AUTHORITY SECTION: nytimes.com. 86400 IN NS ns6.boxsecured.com. nytimes.com. 86400 IN NS ns5.boxsecured.com.
;; ADDITIONAL SECTION: nytimes.com. 14356 IN A 212.1.211.121
;; Query time: 93 msec ;; SERVER: 10.10.10.19#53(10.10.10.19) ;; WHEN: Tue Aug 27 14:17:37 2013 ;; MSG SIZE rcvd: 210
On Aug 27, 2013, at 2:09 PM, Grant Ridder <shortdudey123@gmail.com> wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37 _______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
-- -george william herbert george.herbert@gmail.com
On Tue, Aug 27, 2013 at 02:09:26PM -0700, Grant Ridder wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37
Seems to have changed NSes again (still compromised, it seems): ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +trace nytimes.com ;; global options: +cmd . 518400 IN NS d.root-servers.net. . 518400 IN NS a.root-servers.net. . 518400 IN NS e.root-servers.net. . 518400 IN NS f.root-servers.net. . 518400 IN NS i.root-servers.net. . 518400 IN NS j.root-servers.net. . 518400 IN NS b.root-servers.net. . 518400 IN NS k.root-servers.net. . 518400 IN NS c.root-servers.net. . 518400 IN NS g.root-servers.net. . 518400 IN NS h.root-servers.net. . 518400 IN NS m.root-servers.net. . 518400 IN NS l.root-servers.net. ;; Received 512 bytes from ::1#53(::1) in 7 ms com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. ;; Received 489 bytes from 2001:500:1::803f:235#53(2001:500:1::803f:235) in 132 ms nytimes.com. 172800 IN NS ns27.boxsecured.com. nytimes.com. 172800 IN NS ns28.boxsecured.com. ;; Received 110 bytes from 2001:503:a83e::2:30#53(2001:503:a83e::2:30) in 110 ms nytimes.com. 14400 IN A 212.1.211.121 nytimes.com. 86400 IN NS ns6.boxsecured.com. nytimes.com. 86400 IN NS ns5.boxsecured.com. ;; Received 92 bytes from 212.1.211.126#53(212.1.211.126) in 37 ms -- staticsafe O< ascii ribbon campaign - stop html mail - www.asciiribbon.org Please don't top post. Please don't CC! I'm subscribed to whatever list I just posted on.
On Tue, Aug 27, 2013 at 05:20:06PM -0400, staticsafe <me@staticsafe.ca> wrote a message of 86 lines which said:
Seems to have changed NSes again (still compromised, it seems):
Just changed again (from boxsecured.com to nytimes.com), apparently for the proper ones.
this is what I am seeing: $ dig any nytimes.com ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55086 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ;nytimes.com. IN ANY ;; ANSWER SECTION: nytimes.com. 9945 IN A 141.105.64.37 nytimes.com. 81945 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 81945 IN NS ns2.syrianelectronicarmy.com. ;; AUTHORITY SECTION: nytimes.com. 81945 IN NS ns2.syrianelectronicarmy.com. nytimes.com. 81945 IN NS ns1.syrianelectronicarmy.com. ;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 269 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 215 IN A 141.105.64.37 ;; Query time: 1 msec ;; SERVER: 10.10.89.245#53(10.10.89.245) ;; WHEN: Tue Aug 27 17:42:34 2013 ;; MSG SIZE rcvd: 162 On Tue, Aug 27, 2013 at 5:20 PM, staticsafe <me@staticsafe.ca> wrote:
On Tue, Aug 27, 2013 at 02:09:26PM -0700, Grant Ridder wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37
Seems to have changed NSes again (still compromised, it seems):
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> +trace nytimes.com ;; global options: +cmd . 518400 IN NS d.root-servers.net. . 518400 IN NS a.root-servers.net. . 518400 IN NS e.root-servers.net. . 518400 IN NS f.root-servers.net. . 518400 IN NS i.root-servers.net. . 518400 IN NS j.root-servers.net. . 518400 IN NS b.root-servers.net. . 518400 IN NS k.root-servers.net. . 518400 IN NS c.root-servers.net. . 518400 IN NS g.root-servers.net. . 518400 IN NS h.root-servers.net. . 518400 IN NS m.root-servers.net. . 518400 IN NS l.root-servers.net. ;; Received 512 bytes from ::1#53(::1) in 7 ms
com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. ;; Received 489 bytes from 2001:500:1::803f:235#53(2001:500:1::803f:235) in 132 ms
nytimes.com. 172800 IN NS ns27.boxsecured.com. nytimes.com. 172800 IN NS ns28.boxsecured.com. ;; Received 110 bytes from 2001:503:a83e::2:30#53(2001:503:a83e::2:30) in 110 ms
nytimes.com. 14400 IN A 212.1.211.121 nytimes.com. 86400 IN NS ns6.boxsecured.com. nytimes.com. 86400 IN NS ns5.boxsecured.com. ;; Received 92 bytes from 212.1.211.126#53(212.1.211.126) in 37 ms
-- staticsafe O< ascii ribbon campaign - stop html mail - www.asciiribbon.org Please don't top post. Please don't CC! I'm subscribed to whatever list I just posted on. _______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
NYT is tweeting out their links with the IP 170.149.168.130 so they are still reachable. :) On 27 August 2013 23:09, Grant Ridder <shortdudey123@gmail.com> wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
-- blaze your trail -- Daniël W. Crompton <daniel.crompton@gmail.com> <http://specialbrands.net/> <http://specialbrands.net/> http://specialbrands.net/ <http://twitter.com/webhat> <http://www.facebook.com/webhat><http://plancast.com/webhat><http://www.linkedin.com/in/redhat>
Predicting that it's more widespread than just nytimes.com - compare whois of twimg.com and nytimes.com. On Tue, Aug 27, 2013 at 2:27 PM, Daniël W. Crompton < daniel.crompton@gmail.com> wrote:
NYT is tweeting out their links with the IP 170.149.168.130 so they are still reachable. :)
On 27 August 2013 23:09, Grant Ridder <shortdudey123@gmail.com> wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
;; ADDITIONAL SECTION: ns1.syrianelectronicarmy.com. 47 IN A 141.105.64.37 ns2.syrianelectronicarmy.com. 47 IN A 141.105.64.37
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
-- blaze your trail
-- Daniël W. Crompton <daniel.crompton@gmail.com>
<http://specialbrands.net/> http://specialbrands.net/
<http://twitter.com/webhat> <http://www.facebook.com/webhat><http://plancast.com/webhat><http://www.linkedin.com/in/redhat>
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
On Tue, Aug 27, 2013 at 02:43:51PM -0700, Alex Buie wrote:
Predicting that it's more widespread than just nytimes.com - compare whois of twimg.com and nytimes.com.
https://plus.google.com/u/0/+TheNextWeb/posts/Y62sf1vDqcG -- staticsafe O< ascii ribbon campaign - stop html mail - www.asciiribbon.org Please don't top post. Please don't CC! I'm subscribed to whatever list I just posted on.
On Aug 27, 2013, at 2:43 PM, Alex Buie <alex.buie@frozenfeline.net> wrote:
Predicting that it's more widespread than just nytimes.com - compare whois of twimg.com and nytimes.com.
Twitter got hit as well. Didn't observe it myself, but saw conversation in which people debugged and found the hijacking. -Bill
Think NYT is trying to regain control back but forgot their glue. :-( nytimes.com. 172800 IN NS dns.ewr1.nytimes.com. nytimes.com. 172800 IN NS dns.sea1.nytimes.com. ;; Received 107 bytes from 192.48.79.30#53(j.gtld-servers.net) in 121 ms dig: couldn't get address for 'dns.ewr1.nytimes.com': not found ../C On Tue, Aug 27, 2013 at 2:55 PM, Bill Woodcock <woody@pch.net> wrote:
On Aug 27, 2013, at 2:43 PM, Alex Buie <alex.buie@frozenfeline.net> wrote:
Predicting that it's more widespread than just nytimes.com - compare
whois of twimg.com and nytimes.com.
Twitter got hit as well. Didn't observe it myself, but saw conversation in which people debugged and found the hijacking.
-Bill
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
On Tue, Aug 27, 2013 at 03:11:58PM -0700, Curtis Doty wrote:
Think NYT is trying to regain control back but forgot their glue. :-(
nytimes.com. 172800 IN NS dns.ewr1.nytimes.com. nytimes.com. 172800 IN NS dns.sea1.nytimes.com. ;; Received 107 bytes from 192.48.79.30#53(j.gtld-servers.net) in 121 ms
dig: couldn't get address for 'dns.ewr1.nytimes.com': not found
What server did you query? If you're using the cached NS records for nytimes.com, ...
dig @a.gtld-servers.net www.nytimes.com
;; AUTHORITY SECTION: nytimes.com. 2D IN NS dns.ewr1.nytimes.com. nytimes.com. 2D IN NS dns.sea1.nytimes.com. ;; ADDITIONAL SECTION: dns.ewr1.nytimes.com. 2D IN A 170.149.168.134 dns.sea1.nytimes.com. 2D IN A 170.149.173.133 But from my caching server:
dig NS nytimes.com
;; QUESTION SECTION: ;nytimes.com. IN NS ;; ANSWER SECTION: nytimes.com. 76063 IN NS ns2.syrianelectronicarmy.com. nytimes.com. 76063 IN NS ns1.syrianelectronicarmy.com.
dig @ns1.syrianelectronicarmy.com dns.sea1.nytimes.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 351 -- Brett
On Aug 27, 2013, at 4:09 PM, Grant Ridder <shortdudey123@gmail.com> wrote:
I think someone hijacked NYTimes dns...
http://www.chicagotribune.com/business/technology/chi-new-york-times-website...
Non-authoritative answer: Name: nytimes.com Address: 141.105.64.37
~~~ dig any nytimes.com
; <<>> DiG 9.8.3-P1 <<>> any nytimes.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15335 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION: ;nytimes.com. IN ANY
;; ANSWER SECTION: nytimes.com. 11560 IN A 141.105.64.37 nytimes.com. 5 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 5 IN NS ns2.syrianelectronicarmy.com.
From OpenDNS I see: (208.67.222.222) ;; ANSWER SECTION: nytimes.com. 10699 IN A 141.105.64.37 nytimes.com. 10699 IN MX 0 nytimes.com. nytimes.com. 82699 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 82699 IN NS ns2.syrianelectronicarmy.com. nytimes.com. 86399 IN SOA ns5.boxsecured.com. ssuliman.hotmail.co.uk. 2013082703 86400 7200 3600000 86400 From Google DNS (8.8.8.8) I see: note SOA is different: ;; ANSWER SECTION: nytimes.com. 10897 IN MX 0 nytimes.com. nytimes.com. 18097 IN SOA ns1.syrianelectronicarmy.com. admin.sea.sy. 2013082701 86400 7200 3600000 86400 nytimes.com. 18097 IN NS ns2.syrianelectronicarmy.com. nytimes.com. 18097 IN NS ns1.syrianelectronicarmy.com. nytimes.com. 10897 IN A 141.105.64.37 From our own resolver I see: ;; ANSWER SECTION: nytimes.com. 154278 IN NS dns.sea1.nytimes.com. nytimes.com. 154278 IN NS dns.ewr1.nytimes.com. As for what nytimes.com is resolving to, from trying a few places I see: 141.105.64.37 - 141.105.64.0/21 AS49335 (NCONNECT), where Shorefront Media, Inc/Navitel Rusconnect is registered for 141.105.64.0/26 170.149.172.130 - 170.149.0.0/16 (New York Times)
participants (12)
-
Alex Buie -
Bill Woodcock -
Brett Frankenberger -
Curtis Doty -
Daniël W. Crompton -
George Herbert -
Grant Ridder -
james jones -
John Kinsella -
Kevin Day -
staticsafe -
Stephane Bortzmeyer