text:
Hacking Guatemala's DNS – Spying on Active Directory Users By Exploiting a TLD Misconfiguration
Guatemala City, By Rigostar (Own work) [CC BY-SA 3.0], via Wikimedia Commons.
In search of new interesting high-impact DNS vulnerabilities I decided to take a look at the various top-level domains (TLDs) and analyze their configurations for errors. Upon some initial searching it turns out there is a nice open source service which helps DNS administrators scan their domains for misconfigurations called DNSCheck written by The Internet Foundation in Sweden. This tool helps highlight all sorts of odd DNS misconfigurations such as having an authoritative nameserver list mismatch between a domain's authoritative nameservers and the nameservers set at the parent TLD nameservers (this was the issue causing the domain takeover vulnerabilities in iom.int and sen.gov covered in a previous post). While it doesn't explicitly point out vulnerabilities in these domains it does let us know if something is misconfigured which is as good a place as any to start.
As of the time of this writing there are ~1,519 top level domains. Instead of scanning each TLD one by one by hand I opted to write a script to automate scanning all the TLDs. The output of the results of this script can be found under my Github repo titled TLD Health Report. The script was designed to highlight which TLDs have the most serious misconfigurations. After spending an hour or two reviewing the TLDs with configuration errors I came across an interesting issue with the .gt TLD. The error can be seen on this Github page and is as follows:
Soa Scan
- No address found for maestro.gt. No IPv4 or IPv6 address was found for the host name.
- Error while checking SOA MNAME for gt. (maestro.gt). The SOA MNAME is not a valid host name.
- SOA MNAME for gt. (maestro.gt) not listed as NS. The name server listed as the SOA MNAME is not listed as a name server.
…trimmed for brevity…
As can be seen from the above, multiple errors and warnings state that the domain name maestro.gt is not routable and is an invalid primary master nameserver (MNAME) for the .gt TLD. We can see this configuration in action by doing the following dig command:
[email protected] ~/P/gtmaster> dig SOA randomdomain.gt
; <<>> DiG 9.8.3-P1 <<>> SOA randomdomain.gt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1444
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;randomdomain.gt. IN SOA
gt. 0 IN SOA maestro.gt. alejandra.reynoso.cctld.gt. 2017012900 3600 600 604800 14400
;; Query time: 43 msec
;; WHEN: Sun Jan 29 16:11:57 2017
;; MSG SIZE rcvd: 101
As can be seen above, we receive an NXDOMAIN error (because the domain we requested does not exist) and along with it we get a statement of authority (SOA) record with maestro.gt listed as the master nameserver. Any requests for a non-existent domains under the .gt TLD will return a SOA record with this domain in it.
"Unresolvable" is Just Another Word for "Not Resolvable Yet"
If you've read some of the previous posts on DNS vulnerabilities that I've written you may have already guessed why this domain isn't resolving. It's because it doesn't exist! As it turns out, it's also open for registration. With a bit of searching and Google Translate I found that it was available for registration from the "Registro de Dominios .gt." for around 60$ a year (with a minimum of two years registration).
Would you believe they take Visa?
While pricey, the registration was quick and completely automated which is more than I can say for many other TLDs in Central America. The only drawback was that my debit card was immediately frozen for questionable activity and I had to go online to unfreeze it so that the order could go through:
Apparently buying a Guatemalan domain name at 1:30 AM is grounds for your card being frozen.
Listening for Noise
Due to the SOA MNAME being sort of an esoteric feature of DNS I wasn't sure what to expect in terms of DNS traffic. It was unclear from casual Googling what types of DNS clients and services would actually make use of this field for anything at all. For this reason I configured my Bind DNS server to answer all A record queries for any domain under .gt with the IP address of my server as a general catch-all. I set up tcpdump to dump all DNS traffic into a pcap file for later analysis and let the box sit overnight.
What I found in the morning was far from expected, when I checked the pcap data I found that computers from all over the country of Guatemala were sending DNS queries to my server:What in the world is going on? Looking further into the results only appears to yield more confusion:
A majority of the traffic was in DNS UPDATE queries from internal network IP addresses. The above is an example DNS UPDATE request attempting to update the zone of my DNS server to include an SRV record for an internal LDAP server belonging to a random government network in Guatemala.
So, why all of the DNS queries? If you're familiar with what _ldap._tcp.dc._msdcs is for then you may have already spotted the forest from the trees.
Understanding Windows Active Directory Domains
To understand why we are getting this traffic we have to take a quick diversion to learn about Windows Active Directory (AD) Domains and DDNS (Dynamic DNS).
Windows domains are structured in much the same way as Internet domain names are structured. When creating a Windows domain you must specify a DNS suffix. This DNS suffix is comparable to a base-domain, with all of the sub-domains being either child domains or simply hostnames of machines under the parent domain. As an example, say we have a Windows domain of thehackerblog.com and we have a two Windows Active Directory (AD) networks under this parent domain: east and west. In this structure we would set up two domains under the parent domain of thehackerblog.com as east.thehackerblog.com and west.thehackerblog.com. If we had a dedicated web-server for internal company documentation for the east office under this domain it might have a hostname of documentation.east.thehackerblog.com. In this way we build up a domain-tree of our network, much how is done with the Internet's DNS. The following is our example network as a tree:
These hostnames like documentation.east.thehackerblog.com allow computers and people to easily find each other in this network. The network's DNS server will take these human-readable hostnames and turn them into IP addresses of the specific machines so that your computer knows where to request the information you're looking for. So when, for example, you type in the internal website URL of documentation.east.thehackerblog.com into your web browser, your computer asks the network's DNS server for the IP address of this hostname in order to find it and route traffic to it.
Given this structure a problem does arise. Since machine IP addresses can often change on these networks, what happens when the server behind documentation.east.thehackerblog.com suddenly has a change in IP (say due to a new DHCP lease, etc)? How can the network's DNS servers figure out the new IP address of this machine?
Understanding Windows Dynamic Update
Window's Active Directory networks solve this problem by the use of something called Dynamic Update. Dynamic update at a core is actually very simple. In order to keep records such as documentation.east.thehackerblog.com always fresh and accurate, occasionally these servers will reach out the network's DNS server and update their specific DNS records. For example, if the documentation.east.thehackerblog.com IP address suddenly changed, this server would reach out to the domain's DNS server and say "Hey! My IP changed, please update the documentation.east.thehackerblog.com record to point to my new IP so people know where I am!". A real world comparable situation would be a person moving apartments and having to notify their friends, workplace, and online shopping outlets of this new location to reach them at via mail.
The process for this a bit technical (I've summarized it below) and is as follows (quoted from "Understanding Dynamic Update"):
- The DNS Client service sends a start of authority (SOA)–type query using the DNS domain name of the computer.
- The DNS Client service sends a start of authority (SOA)–type query using the DNS domain name of the computer.
- The client computer uses the currently configured FQDN of the computer (such as newhost.tailspintoys.com) as the name that is specified in this query.
- For standard primary zones, the primary server (owner) that is returned in the SOA query response is fixed and static. It always matches the exact DNS name as it appears in the SOA resource record that is stored with the zone. If, however, the zone being updated is directory integrated, any DNS server that is loading the zone can respond and dynamically insert its own name as the primary server (owner) of the zone in the SOA query response.
- The DNS Client service then attempts to contact the primary DNS server.
- The client processes the SOA query response for its name to determine the IP address of the DNS server that is authorized as the primary server for accepting its name. It then proceeds to perform the following sequence of steps as needed to contact and dynamically update its primary server
- It sends a dynamic update request to the primary server that is determined in the SOA query response.
If the update succeeds, no further action is taken.
- If this update fails, the client next sends a name server (NS)–type query for the zone name that is specified in the SOA record.
- When it receives a response to this query, it sends an SOA query to the first DNS server that is listed in the response.
- After the SOA query is resolved, the client sends a dynamic update to the server that is specified in the returned SOA record.
If the update succeeds, no further action is taken.
- If this update fails, the client repeats the SOA query process by sending to the next DNS server that is listed in the response.
- It sends a dynamic update request to the primary server that is determined in the SOA query response.
- The client processes the SOA query response for its name to determine the IP address of the DNS server that is authorized as the primary server for accepting its name. It then proceeds to perform the following sequence of steps as needed to contact and dynamically update its primary server
- After the primary server that can perform the update is contacted, the client sends the update request and the server processes it.
The contents of the update request include instructions to add host (A) (and possibly pointer (PTR)) resource records for newhost.tailspintoys.com and to remove these same record types for oldhost.tailspintoys.com, the name that was registered previously.
The server also checks to ensure that updates are permitted for the client request. For standard primary zones, dynamic updates are not secured; therefore, any client attempt to update succeeds. For AD DS-integrated zones, updates are secured and performed using directory-based security settings.
The above process is long-winded and can be a lot to consume at first so I've bolded the important sections. Summing this up the client does the following:
- A SOA query with the full hostname of the current machine is sent to the network DNS server by the host. In our previous example this would be a query containing documentation.east.thehackerblog.com as a hostname.
- The network's DNS server receives this request and replies with a SOA record of its own which specifies what the hostname of the master nameserver is. This may be something like ns1.thehackerblog.com, for example.
- The client then parses this SOA record and then reaches out to ns1.thehackerblog.com specified in the previous server's SOA MNAME reply with the DNS update/change it would like to make.
- The ns1.thehackerblog.com DNS server receives this update and changes its records to match accordingly. The DNS record for documentation.east.thehackerblog.com now points to the host's new IP address and everything routes properly again!
Windows Domain Naming Conventions & Best Practice Guidelines
The final piece of information we need to absorb before we understand our Guatemalan DNS anomaly is the following requirement for Windows domains:
"By default, the DNS client does not attempt dynamic update of top-level domain (TLD) zones. Any zone that is named with a single-label name is considered to be a TLD zone, for example, com, edu, blank, my-company. To configure a DNS client to allow the dynamic update of TLD zones, you can use the Update Top Level Domain Zones policy setting or you can modify the registry."
So by default you can't have a Windows domain of companydomain, for example, because it's single-label and is considered by Windows to be a top level domain (TLD) like .com, .net, or .gt. While this setting can (hopefully) be disabled on each individual DNS client (read: every computer in your network), it's much easier just to have a domain of companydomain.com. While not all companies follow this direction, it is highly recommended because having a single-label domain could potentially cause many conflictions down the line if your internal network domain ends up being registered as a top-level domain in the Internet's DNS root zone (an issue known as Name Collision which was, and continues to be, a hotly discussed topic in Internet discussions).
Putting it All Together – Becoming Master of Your Domain!
Now that we have all of this information, the situation becomes quite a bit more clear. The country of Guatemala like has many Windows networks which have internal Windows domains that are sub-domains of the .gt TLD. For example, if Microsoft had an office in Guatemala their internal network domain might be something like microsoftinternal.com.gt. These machines periodically make dynamic DNS updates to their network DNS server to ensure that all of the network's hostnames are up-to-date and routing properly. For a variety of reasons such as prevention of name collisions with external company Internet sub-domains, it's also likely that many networks make use of internal network domains which don't exist on the wider Internet. For example in this case Microsoft may use an internal active directory domain name such as microsoftinternal.com.gt since hosts under this domain wouldn't ever have naming conflicts with external Internet sub-domains for microsoft.com.gt.
The issue is, many subtle DNS misconfigurations can cause DNS requests which should be for the internal domain's DNS server, to hit the top level domain's (TLD) servers instead. This issue is known as name collision and is a well-documented issue which is sometimes referred to as DNS queries "leaking". If a machine uses a DNS resolver which is not aware of the internal network's DNS setup, or is misconfigured to pass these queries on to the outer-Internet's DNS servers then these queries are leaked to the .gt TLD servers since they are the delegated nameservers for that entire TLD space. The problem of name collisions is incredibly common and is the same reason why new TLDs are often put up to a large amount of scrutiny to make sure that they aren't a common internal network domain name such as .local, .localhost, .localdomain, etc.
When this leaking occurs for an internal domain that is part of the .gt extension, the DNS UPDATE query sent by a machine attempting to update an internal DNS record accidentally is sent to the .gt TLD servers. Say, for example, we are a host on the microsoftinternal.com.gt internal domain and we send our DNS UPDATE query to a com.gt TLD server. The following is an example of this query performed with the nsupdate DNS command line tool (available on most OS X and Linux systems):
[email protected] ~/P/gtmaster> nsupdate -d
> prereq nxdomain printer.microsoftinternal.com.gt
> update add printer.microsoftinternal.com.gt 800 A 172.16.3.131
> send
Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 25175
;; flags: qr rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;printer.microsoftinternal.com.gt. IN SOA
com.gt. 0 IN SOA maestro.gt. alejandra.reynoso.cctld.gt. 2017012812 3600 600 604800 14400
Found zone name: com.gt
The master is: maestro.gt
Sending update to 22.214.171.124#53
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 62645
;; flags:; ZONE: 1, PREREQ: 1, UPDATE: 1, ADDITIONAL: 0
printer.microsoftinternal.com.gt. 0 NONE ANY
printer.microsoftinternal.com.gt. 800 IN A 172.16.3.131
Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOTAUTH, id: 62645
;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;com.gt. IN SOA
We can see that the query resulted in a NXDOMAIN error but regardless an SOA response is returned with maestro.gt as the master nameserver. Since this is exactly what the host was looking (e.g. it's a valid SOA response to this query) it parses out maestro.gt MNAME and proceeds to send the DNS update query to the server behind maestro.gt hosted at 22.214.171.124 (my server). This query ends in failure because I've set up my DNS server to reject all update requests from clients (since I don't want to actively interfere with these machines/networks). This is why all of these random machines are sending DNS update requests to my maestro.gt server.
What we have is essentially an new DNS issue which is the result of name collisions leading to dynamic DNS updates being sent to whatever server is listed under a TLD's SOA record. Unlike regular name collisions though, we don't need to register an entirely new TLD to exploit this issue we just need to register the domain name listed under an existing TLD's SOA record (as we did with maestro.gt).
Try It Yourself – A Quick Lab
Note: Feel free to skip this section if you're not interested in replicating these results personally.
If you'd like to see this behavior in action it's actually fairly simple to replicate. We'll use Windows 7 as our example OS inside of VMware along with Wireshark running to follow all the DNS traffic being sent by our machine.
To change your computer's DNS suffix to match what a Guatemalan active directory domain might look like, go to Start > Computer > System Properties > Change Settings > Change > More and set the primary DNS suffix to any domain under the .gt TLD:
Click OK and apply this new setting, you will be prompted to restart your computer. Go ahead and do so and keep Wireshark running while Windows is starting up. You should see that during the startup process a few Dynamic Update queries are issued:
The above screenshot of my Wireshark output shows that the Windows VM did the following upon startup:
- Attempts to query the 126.96.36.199 DNS resolver for the SOA of mandatory.dnsleaktestnetwork.com.gt (Resulting in an NXDOMAIN error because that record doesn't exist on the public Internet which 184.108.40.206 is configured to query).
- Windows then parses this NXDOMAIN response and finds a valid SOA MNAME record of maestro.gt in the response sent from the TLD.
- Windows then reaches out to maestro.gt (my server) and attempts to do a DNS UPDATE request. This fails because my server is configured to refuse all of these requests.
- Windows then attempts the entire process over again, this time in all capital letters instead (???).
We've now seen in-action exactly what goes on with these Windows machines that are hitting the maestro.gt server.
So, Just How Common Is This Issue?
Since Guatemala, and by proxy, the .gt domain space, is relatively small in comparison to the bigger top level domains such as .com, .net, .org, .us, etc we can only see a small fraction of the global number of DNS requests made due to this issue. On the larger scale, it's likely that a huge amount of traffic is generated to many of the more-popular TLD nameservers from networks which utilize this TLD in their AD domain.
Luckily, while I haven't been able to find any previous exploit research on Dynamic Update SOA hijacking specifically, we do have a great deal of past-research on name collisions in general. This is largely because of worries about newly issued TLDs conflicting with internal network domains which are utilized by computers/networks across the world. For a good overview of this problem and research into how widespread it is I recommend reading Name Collision in the DNS, a report commission by ICANN to better understand the name collision problem and its effects on the wider Internet. This reports contains lots of real-world data on just how big the name collision problem is and allows us a good base to extrapolate how widespread this specific SOA Dynamic Update variant is in the wild.
Perhaps the most damning piece of real world data that was collected and presented in this report is the following table:
The above table is from a ranked list of requested TLDs ordered by number of DNS requests to the roots (in thousands). The list in the report contains the top 100 TLDs in the original report but the above image truncates it to just 20. This table sheds some light on the raw number of leaked DNS requests actually hitting the roots that were never meant to end up there at all. As can be seen, requests for the invalid TLD of .local account for more requests to the DNS roots than all .org and .arpa requests combined – ranking as the 3rd most requested TLD overall! The following pie chart also sheds further light onto the scale of the problem:
The above chart shows that a shocking 45% of requests to the root servers are for TLDs which do not exist and are likely the result of leaked DNS requests. Perhaps even more shocking is that the number is likely even higher due to the possibility of internal domains having a valid top level domain but an invalid second level domain, such as the previously mentioned microsoftinternal.com.gt. These requests would appear valid to the roots (since .gt is a valid record in the root zone) but would be revealed as leaked/invalid once they hit the com.gt TLD servers.
What's also very interesting is that the report appears to mention that they observed traffic stemming from this problem but did not appear to investigate it much:
5.4.5 Name includes _ldap or _kerberos at the lowest level
Patterns observed show many requests of one of the forms:
- _ldap._tcp.dc._msdcs.<etc.>
- _ldap._tcp.pdc._msdcs.<etc.>
- _ldap._tcp.<etc.>._sites.dc._msdcs.<etc.>
- _ldap._tcp.<etc.>._sites.gc._msdcs.<etc.>
- _ldap._tcp.<etc.>._sites.<etc.>
- _ldap._tcp.<etc.>
- _kerberos._tcp.dc._msdcs.<etc.>
- _kerberos._tcp.<etc.>._sites.dc._msdcs.<etc.>
- _kerberos._tcp.<etc.>._sites.<etc.>
- _kerberos._tcp.<etc.>
Typically these are queries for SRV records, although sometimes they are requests for SOA
records. They appear to be related to Microsoft Active Directory services.
Look familiar? The above remark about SOA records is almost certainly traffic being generated from this exact same issue. It is mentioned again later in the report as well:
Although the overwhelming majority of the observed DNS traffic in this study has been name lookups (i.e., conventional queries), some other DNS requests have been detected. These are mostly Dynamic Updates—traffic that should never reach the root servers. After all, changes to the DNS root are not carried out using Dynamic Updates, let alone ones originating from random IP addresses on the Internet. The most likely explanation for this behavior would be misconfigured Active Directory installations that leak from an internal network to the public Internet. It should be noted however that this study did not examine the root cause of this traffic.
The statement eventually concludes with:
It is not known what impact, if any, this might have on the end client or how this could change its subsequent behavior. Currently, no significant harm appears to result when these Dynamic Update requests receive a REFUSED or NOTAUTH error response. Returning a referral response after example is delegated at the root might cause these clients to fail or behave unexpectedly. It seems likely that this would create end user confusion and support problems for the organization's IT department.
Sadly this report doesn't make any statements about the actual volume of this traffic so we're unable to get a good idea of the percentage/total scale of this issue in comparison to other name collisions. The report also fails to realize that the security considerations are actually much larger in scope due to the fact that a SOA MNAME returned by TLDs could potentially be a completely arbitrary domain (as was the case with .gt and maestro.gt). This allows for potentially any attacker to get in the middle of these DNS transactions via a domain registration just as we exploited for .gt.
Given this admittedly limited information, I don't think it's a big reach to assume that this issue is actively occurring at-scale and many of the top level domain servers must see a non-trivial amount of traffic from this problem. Depending on the specific configuration of each TLD's SOA record they may also be vulnerability to exploitation if their SOA MNAME is available for registration like the case was here.
Fixing the Problem & Wider TLD Security Considerations
Given that the barrier to entry for exploiting this problem is so low (essentially just buying a domain name), and the impact seems to be of concern for a number of reasons, I don't feel it would be unreasonable to require TLDs to ensure that the SOA MNAME field of their responses be non-resolvable, or resolvable to a TLD-controlled server which refuses to process these dynamic update queries. Given that this mistake appears to be easy to make due to the SOA MNAME field not really being used for DNS-slave replication much anymore, I don't feel this change should be too unreasonable. Sadly, if you review over the results of the generated TLD Health Report mentioned earlier in this post you'll see that a shocking number of TLDs are actually very broken in the functional sense. Given this fact, the hope for enforcement of this security concern is low given that even simple things like "having all the TLD nameserver in a working state" are not currently universally true for TLDs. If we can't even ensure that TLDs are healthy in general how can we ever hope to ensure that all TLDs are mitigating this issue?
Calling on network administrators to prevent issues of this type in their own networks does not appear to be a winnable war either given the scale of DNS name collisions. While it's important to notify and ensure that network admins understand this risk, ensuring that 100% of networks always configure things properly is a bit of a pipe dream.
A Privacy Nightmare
Given the fact that these machines in Guatemala appear to call out on a pretty regular basis there are some fairly big privacy concerns with this issue. Many of the DNS requests had hostnames which were very personal in nature (think NANCY-PC, MYLAPTOP, etc). Since a DNS UPDATE query is sent due to a variety of triggers this would mean the user's personal computer would be phoning home to my nameserver every time they travelled, changed networks, or rebooted their machine. This would make it easy to monitor someone as they take their laptop from work, to home, to the local cafe, and so on. The internal IP addresses add to the privacy risk as well, given that it helps map out the remote network's IP scheme. All the while these people have no idea that their computer was silently reporting their location. Imagine something like the following being built based off of this data:
Note: The above map doesn't reflect any real data and is purely for illustrative purposes.
Needless to say, the privacy concerns might raise a few eyebrows.
Ethical Handling of Research Data
Out of respect for the privacy of the people of the Guatemala the raw update query data collected from this research will never be published and has been securely deleted. Additionally, all further traffic from these computers will be routed to 127.0.53.53 to ensure that no further UPDATE queries will be sent for the rest of my maestro.gt domain registration term (of about two years). The IP address 127.0.53.53 is special because it was specifically commissioned by ICANN to warn network administrators of name collision issues. The hope being that if a network admin/tech savvy user in Guatemala sees DNS traffic being routed to this IP they will Google it and immediately find that their network/AD setup is vulnerable to this issue.
Additionally I've emailed the DNS admin of the .gt TLD informing her of this issue and asked that she change the MNAME to something no-longer resolvable. Since nobody else can abuse this, combined with the fact that I'm sinkholing all DNS traffic to 127.0.53.53, combined further with the fact that my domain registration term is two years – I've decided to publish this post despite the MNAME still being maestro.gt as of this time. I imagine that two years of time for a patch falls within reason for patch expectations :).
Overall this was a fun experiment and highlights some very interesting ramifications of even minor TLD misconfigurations such as this one.
Until next time,
Via: thehackerblog.com


text:
Since the demise of Phoenix's lone cheese shop, Petit Fromage, Valley cheese lovers have been patiently waiting for the cheese gods to again bless us with a new place to pick up chunks of Gouda, Asiago and Brie.
Good news -- the wait is over.
Wedge & Bottle, the Valley's newest cheese shop, quietly opened its doors May 3rd in Awhatukee next to the Chandler Blvd. Trader Joe's. The shop offers 75 different types of local, domestic and imported cheeses along with a selection of charcuterie meats, wine, beer and specialty jams, honey, pasta and oils.
The shop isn't just for take out -- stop in for one of the shops signature hot sandwiches on fresh bread or nibble on a cheese plate while you unwind with a glass of wine.
If you like this story, consider signing up for our email newsletters.
You have successfully signed up for your selected newsletter(s) - please keep an eye on your mailbox, we're movin' in!
Wedge & Bottle is open Tuesday - Sunday 11 - 7 p.m. Closed Monday. Check out their website wedgebottle.com and mark your calenders for the official grand opening party June 25th.

subset: commoncrawl


text:
A new addition to our 2018 programme is the 3-star Oscar Park, part of the Oscar Group of Hotels. The hotel is perched somewhat 3.5 miles from Famagusta town centre, and a short distance from the famous ancient ruins of Salamis.
The hotel has been carefully designed to include all the modern and contemporary comforts, yet at the same the hotel illustrates small elements of luxury to make one feel they have booked more than just a basic 3-star hotel.
All rooms are of the same standard and are spread across 3 levels with either a terrace or balcony. Amenities within the rooms include air condition/heating, en-suite shower, mini bar, TV, safety deposit box (chargeable), hairdryer and direct dial telephone.
The hotel is bordered by stunning pine trees, overlooking the hotels outdoor swimming pool. There is a pathway leading from the hotel grounds to an impressive sandy beach. The hotel has one main restaurant that serves a la carte for breakfast and dinner if you are on a half board basis. The Irish bar is also popular for those that wish to relax and wind down at the end of the day.
Total Saving Today
Total Price
If you cant find what you are looking for, let us find it for you.
Call 0208 547 2857 or click here to submit a holiday enquiry
Order your free holiday brochure


text:
Rescue teams have found a loader upside down in a Waihi gold mine tonight, but the man driving it remains missing, a mine spokesman has confirmed.
Emergency services rushed to the Correnso underground this evening after they were told a large front end loader had rolled and a male worker was not responding to radio calls.
Rescue teams began searching through 40km of tunnels in mine after the alarm was raised at 6.30pm.
Almost four hours after the incident contact had not been made, but senior community advisor at Oceana Gold in Waihi, Kit Wilson, said just before 11.30pm that the 10 metre long loader had been found.
It had not gone down a shaft, but a "stoop", which is a tunnel that opens into a cavern-like area.
Rescuers had not found the driver, who he confirmed is male, and were looking for him, Wilson said.
A police spokesperson said earlier this evening the Mine Incident Controller was leading the rescue effort of the underground mine rescue team and police were co-ordinating at the scene. All mining activities in the area had been halted.
Wilson said earlier mine management were alerted when a manager called the company and said they couldn't reach a worker by radio.
Northern Ambulance Communications' team leader Ngaire Jones said an ambulance was on scene waiting for a patient to be brought out of the mine.
"We believe there is someone trapped ... fire are organising rescue and the Westpac Rescue Helicopter from Auckland are on the scene.
Emergency services were called at 6.35pm and the ambulance had been on the scene since 7.15pm, she said.
A Northern Fire Commuications' spokesman referred enquiries to police.


text:
Looking for the secrets to financing your business?
There is more than one way to finance your business so you can take it to the next level. The Secrets to Financing® your business educational series includes discussions from funding professionals about
- Traditional Bank Lending
- Angel Investors
- Revolving Loan Funds
- Venture Debt
- Private Equity
- Account Receivable Financing
- and more
You will learn which options are right for you and how to get started.
Click here to register for our next event!


text:
Helen Hayes, the "First Lady of American stage," as she was called by the audiences she captivated with her talent, grace, and charm, is best known for playing the roles of Queen Victoria and Mary, Queen of Scots.
Hayes was born in 1900, in Washington, DC, to Francis Van Arnum and Catherine Estelle Brown. Her father worked as a manager and salesman for a wholesale butcher. Her mother was an actress with different touring companies, but was deeply frustrated by her unfulfilled dreams of becoming famous. Hayes was influenced by her mother and maternal grandmother to become an actress herself.
Hayes made her first stage appearance as a student in Miss Minnie Hawkes'dancing school playing a Gibson Girl at the school's May ball. She joined the Columbia Players, a Washington, DC company, in 1905. At age 5. she made her professional debut as Prince Charles in The Royal Family. Little did she know she would go on to portray other members of royalty in many distinguished roles to come.
In 1909, Hayes made her New York debut at the Herald Square Theater as Little Mime in Lew Fields' production of Old Dutch. She, then, went back to Washington, DC to enter the Academy of Sacred Heart Convent, from which she graduated in 1917. Soon after her graduation, Hayes opened as the lead in Pollyanna and toured the country during the 1917-18 season.
From 1922 to 1924, Hayes performed in a production of To the Ladies both in New York and on tour. Next, she played in Oliver Goldsmith's ribald 18th century comedy She Stoops to Conquer. In 1925, she played Cleopatra in Shaw's Caesar and Cleopatra.
Hayes met the man who would become her husband, Charles MacArthur, just before playing Cleopatra. They were married in 1928 and had several children. She stated once that she handled the raising of her children "like it was another role to learn" because she wanted to be "the best mother there was."
Hayes's performance as Maggie Wylie in J.M. Barrie's What Every Woman Knows created a huge sensation. She made her feature film debut in 1931, starring in The Sin of Madelon Claudet, a role that won her an Oscar for Best Actress. Also, that year, she played opposite Gary Cooper in the film version of Hemingway's A Farewell to Arms.
In late 1933, Hayes opened in her legendary role as Mary Stuart in Mary of Scotland. The play was written by Maxwell Anderson, especially for her. Her next role as royalty was offered to her in 1935. On December 12 of that year, she opened in Baltimore as Queen Victoria in Victoria Regina. Soon, the play moved to the Broadhurst Theater on Broadway and ran for 123 weeks. The produciton continued to break box office records when Hayes took it on a tour of 43 cities in the United States.
The role of Queen Victoria was a demanding one, in which Hayes had to age 82 years in two and one-half hours. She performed the role an astounding 969 times in four years. Asked many years later about how she prepared for the role of Victoria, Hayes said her grandmother, a devotee of Queen Victoria, had always worn the bonnet that was high Victorian fashion and conducted herself like her idol. Hayes would imagine her grandmother every night when she played the role.
In 1939, Hayes played in Ladies and Gentlemen, a play her husband wrote with Ben Hecht. She always said that her husband helped her in every role she ever played by teaching her his approach to acting, which was a belief that nothing should be overstated, but instead, it should be "concise and to the point".
Hayes produced and acted in "Helen Hayes Theater" on the CBS Radio Network from September 1940 to December 1941. In a 1941 national poll, she was voted radio's best actress. In March of 1944, she brilliantly played another historical figure, Harriet Beecher Stowe, on stage for seven months.
On July 28, 1946, Hayes made her London debut, as Amanda Wingfield in The Glass Menagerie, by Tennessee Williams. Several years later, she starred in another hit, Mrs. McThing, as Mrs. Howard V. LaRue. Her performance was hailed as "funny," "moving," and "altogether superb."
On November 21, 1955, New York's Fulton Theater was renamed in her honor. She continued to perform for the next 15 years with same creativity that made her famous. She won an Academy Award in 1970, for her role in Airport, making her the only actress ever to win Academy Awards in both the Best Actress and Best Supporting Actress categories.
Hayes gave her final stage performance in 1971, in Long Day's Journey Into Night. It was at this time that she revealed that she was allergic to dust and that she had been hospitalized for brief periods during every one of her stage performances in the last 30 years. In the middle of her run in Long Day's Journey, her doctor ordered her to quit the stage or she would surely die.
Hayes kept herself busy during the following years by starring in a television series called "The Snoop Sisters" and by writing four books: Star on Her Forehead, On Reflection, Twice Over Lightly, and A Gift of Joy. She continued to be in the public eye as spokesperson for Meals on Wheels and presiding over the annual Helen Hayes Awards for theater in Washington, DC. She also appeared on television and in movies, including Disney's Candleshoe with Jodie Foster in 1977 and a pair of TV movie versions of Agatha Christie's A Caribbean Mystery and Murder With Mirrors in the mid-1980s.
The many awards she won during her career include three Tony awards--one for Happy Birthday (1947), one for Time Remebered (1958), and a special one for career achievement (1980), the two Oscars mentioned earlier, an Emmy for her work in television (1952), and a Grammy for her recording of the Bill of Rights (1976). Hayes died in Nyack, New York at the age of 92.


text: Pixoto's prints are great quality, but when they ship through Expedited UPS the shipping company doesn't update tracking. I ordered a picture last week for an event next week and I got a notice that it was shipped Monday, but the shipping company hasn't updated the tracking and I don't know if I'll have my print ready for the event in time. I have to have it framed and in the mailed to the planners of the event by the 14th of March.


text:
Box Score | Photos | Season Stats | 2016-17 Schedule | Tickets
The Basics
Score: IUPUI 91 – Oral Roberts 85
Records: IUPUI (8-11, 2-3 SL) – ORU (5-14, 1-4 SL)
Location: Tulsa, Okla. (Mabee Center)
TULSA, Okla. – Down 11 with six minutes to play, the Oral Roberts men's basketball team charged back and made it a one-point game with 32 seconds to play but couldn't complete the comeback against IUPUI Saturday afternoon at the Mabee Center.
During halftime of the contest ORU honored its four newest members of the Hall of Fame; Tyler Saladino (baseball), Sam McCants (men's basketball), Faithy Kamangila (cross country) and Charleton Dechert (men's golf).
Kris Martin led the ORU attack with 25 points while Albert Owens fought through a double team all afternoon to score 21. Aaron Anderson (5) and Jalen Bradley (4) combined to dish out nine of ORU's 17 assists. Owens once again narrowly missed a double-double with nine rebounds, matching his career high and marking the sixth time in his career with nine boards.
D.J. McCall led the Jaguars with 21 points on an 8-12 shooting effort as the Jaguars shot 55 percent (34-62) for the game, including 66 percent (22-33) in the first half. Evan Hall had eight rebounds to help IUPUI to a 36-25 rebounding advantage.
Quote of the Game
"Give IUPUI credit, they outplayed us and deserved to win. We waited 36 minutes to start playing desperate basketball and it was too late. They beat us to loose balls and beat us offensive rebounding. It amazes me that we spend so much time in practice working on our defense and we show them on film and there is no carryover." – Head Coach Scott Sutton
Turning Point
Martin drew the foul and hit a pair of free throws to make it a one point game with 36 seconds to play. IUPUI went 7-8 from the free throw line from that point on to hold off the ORU charge.
Individual Leaders
Oral Roberts: Martin (25) and Owens (21) led the way offensively while Owens grabbed a team-high nine rebounds.
IUPUI: McCall's 21 points led the way for the Jaguars while Hall grabbed eight rebounds.
Inside the Box Score
- ORU shot 50 percent (30-60) from the field and 53 percent (9-17) from 3-point range.
- For the second game in a row or shot better than 90 percent from the free throw line. ORU is 39-41 from the charity stripe in the last two games.
- IUPUI connected on 55 percent (34-62) from the field and 50 percent (11-22) from 3-point range. The Jaguars shot 12-18 from the free throw line.
- IUPUI held a 36-25 advantage on the boards and turned it into a 16-11 edge in second chance points.
News and Notes
- ORU has shot 50 percent or better three times this season but done so each of the last two games.
- Owens has now scored at least 20 points in four straight games and is averaging 20.8 points per game in Summit League play.
- ORU had won four in a row inside the Mabee Center until Saturday's loss.
Up Next
ORU will remain at home next week as the Golden Eagles host South Dakota on Wednesday, January 18 and then host Omaha Saturday, January 21.
For the latest information on ORU men's basketball, follow @ORUMBB on Twitter or Instagram or go to www.ORUAthletics.com. Fans can also receive updates on the team by downloading the ORU Athletics Front Row App at ORUAthletics.com/frontrow or the ORU Golden Eagles Live App in iTunes or the Google Play Store.