- NANOG - lists.nanog.org

Verisign Countermeasures - BIND and djbdns patches
by Adam Langley 16 Sep '03

16 Sep '03

On Tue, Sep 16, 2003 at 04:03:08PM +0100, Adam Langley wrote: I'm collecting countermeasures to the verisign wildcard DNS records at http://www.imperialviolet.org/dnsfix.html. Currently there are patches for BIND 9.2.2 and djbdns (not authored by myself) and a Linux userland/netfilter program that rewrites DNS packets (which is). If anyone has other patches/countermeasures I'm happy to maintain a list of links at the above URL. -- Adam Langley agl(a)imperialviolet.org http://www.imperialviolet.org (+44) (0)7906 332512 PGP: 9113 256A CC0F 71A6 4C84 5087 CDA5 52DF 2CB6 3D60

3 2

Verisign's legal woes???
by Roy 16 Sep '03

16 Sep '03

I am just wondering how long until some sharp lawyer sues the heck out of Verisign. While one could argue about who owns unregistered names, there is little or no question about who owns registered names. Verisign's current implementation breaks down for registered names that are not in the zone for some reason. The legal problems 1. This could be considered hijacking of the domain name 2. If the domain name is trademarked, it could be a trademark violation 3. If a registered name goes on HOLD for a day, mail service is suspended (most MTAs keep retrying when the name doesn't resolve). Under the new scheme it all bounces 4. By bouncing mail using the name, it could be the unauthorized use of a domain (that's a crime in California) If one wants to experiment, use dorkslayers.com as your test case. Its a valid paid-for active domain name with no nameservers. Might make a nice class action suit on behalf of all the owners of domain names that aren't in the zone. Could be worth a lot of legal fees.

3 2

Verisign's New Change and Outdate RBL's
by Patrick Muldoon 16 Sep '03

16 Sep '03

Was playing with a test box here at home. Installed SpamAssassian from a newely cvsup'd ports tree on a FreeBSD box, and was surprised to see messages getting marked as received in blacklists that no longer exist. Most noteably ORBS. Since this was a fresh Install I hadn't gone through and removed the dead RBL's from 20_head_tests.cf yet. Since dorkslayers doesn't exist. any queries for it are returning that infamous sitefinder address. [doon@fawkes doon]$ host 34.131.246.64.orbs.dorkslayers.com 34.131.246.64.orbs.dorkslayers.com has address 64.94.110.11 So anybody that hasn't update their SpamAssassian config, now has the added benefit of all ip's being tagged as an open relay. Just an FYI -Patrick

2 1

Verisign changes violates RFC2821
by Avleen Vig 16 Sep '03

16 Sep '03

Just to make it clear, RFC2821 is likely being violated: - The reserved mailbox name "postmaster" may be used in a RCPT command without domain qualification (see section 4.1.1.3) and MUST be accepted if so used. This is *probably* being violated, but I'm not sure as it gets ambiguous later. However, returning a 550 is very wrong. The correct reply should be either: 554 Transaction failed (Or, in the case of a connection-opening response, "No SMTP service here") or: 502 Command not implemented

1 0

Verisign HOWTO
by Chris Roberts 16 Sep '03

16 Sep '03

I've been asked to forward this here on behalf of Martin A Brooks martin(a)hinterlands.org: http://www.hinterlands.org/ver/txt It's a 'How to get your IP block removed from the list that Verisign will reply with SiteFinder for'. Cheers, Chris.

2 1

Re: What *are* they smoking?
by Miquel van Smoorenburg 16 Sep '03

16 Sep '03

In article <cistron.Pine.GSO.4.56.0309151931440.12273@westnet>, Christopher X. Candreva <chris(a)westnet.com> wrote: >This also blows away the whole idea of rejeting mail from non-existant >domains -- never mind all the bounces to these non-existant domains when the >spammers get ahold of them. Boy, I hope they have a good mail server >responding with the 550 on that IP ! Oh yes, top of the line: $ telnet ariekanariebla.net 25 Trying 64.94.110.11... Connected to sitefinder-idn.verisign.com. Escape character is '^]'. 220 snubby3-wceast Snubby Mail Rejector Daemon v1.3 ready syntaxerror 250 OK quit 221 snubby3-wceast Snubby Mail Rejector Daemon v1.3 closing transmission channel 221 snubby3-wceast Snubby Mail Rejector Daemon v1.3 closing transmission channel Connection closed by foreign host. Mike. -- The big problem with blacksmithing resumes is that most of them are forged. -- Joe Marshall

2 1

Re: Change to .com/.net behavior
by George William Herbert 16 Sep '03

16 Sep '03

I would like to make a few evolving observations about the wildcard DNS entries which Verisign initiated in .net and .com earlier today. 1) By all reasonable interpretations, Verisign is now operating in violation of the .com and .net Registry Agreements. Specifically, Sect 24 of the main agreement for .com and Sect 3.5.3, 3.5.5, and 3.6, 3.8 of the main agreement for .net, and the rather blank Appendix X. I believe it to be trivial to demonstrate that even if Verisign issued an ammended Appendix X, such a wildcard entry will exceed the numerical limits specified of 5000 domains, and that the anti-competitive and code of conduct sections will still apply and prohibit this behaviour. Explicitly. 2) By any reasonable interpretation this sort of change should have been clearly announced beforehand to technical communities that would be affected, including but not limited to NANOG, and was not. 3) By any reasonable interpretation this sort of change should have been clearly announced beforehand to policy communities that would be affected, and was not. 4) By any reasonable interpretation of safe and conservative operational procedure, when the various technical and policy issues which were raised over the course of today were made public, Verisign should have rolled the changes back out and announced so until such time as at least *proper* and extensive announcements were made, preferably until such time as Verisign obtained technical community and policy community approval. Verisign has not done so as of when this email was being prepared, at least not querying A.GTLD... 5) An organization which displays this sort of behaviour is not a reasonable candidate from an operational standpoint to stand as the manager of any GTLD. 6) An organization which displays this sort of behaviour is not a reasonable candidate from a legal standpoint to stand as the manager of any GTLD. 7) An organization which displays this sort of behaviour is not a reasonable candidate from a technical standpoint to stand as technical manager of any GTLD or the registrar coordination processes. 8) An organization which displays these sorts of behaviours clearly calls into question the operating assumptions about fair registrar behaviour in the .com and .net registry agreements and thus the entire validity of allowing one company to both manage and act as a registrar for those domains. 9) The apparent complete lack of clue on Verisigns' part as to the magnitude of the hornets nest that this change would kick over, and its lack of any appropriate responses even simply better wider information releases, calls into question the suitability of Verisign's staff and management structure for operating the key central registry functions. 10) Given items 1-9, I call upon ICANN to immediately launch an investegation into the validity and legality of Verisign's wildcard DNS entries; into the operational procedures Verisign is using; into the apparent material breach of Verisign's .com and .net management contracts; and into the suitability of Verisign to remain the .com and .net manager in the future and in pariticular the suitability of the current Verisign management team for participation in that key neutral operational role. I specifically request that ICANN initiate community policy discussions as to whether the GTLD management functions should be required to be spun off into a separate entity from Verisign and not sharing any ownership or management structure. 11) Given items 1-9, I call upon the Department of Commerce to immediately investigate whether Verisign is in material breach of its cooperative agreements and whether Verisign in its current form and with its current staff are suitable to remain manager of the .com and .net GTLDs, and the same set of questions I pose to ICANN, in such areas as DOC is engaged in policymaking regarding Internet Domain Names. -george william herbert gherbert(a)retro.com

1 0

Where will Verisign stop?
by E.B. Dreger 16 Sep '03

16 Sep '03

Someone mentioned earlier that Verisign could issue an official- looking cert for an invalid domain. They accidentally issued a cert to a Microsoft imposter. Although it presumably would be illegal (IANAL), what's to say a valid cert wouldn't "accidentally" be issued for a competitor at the same time DNS records "accidentally" pointed to the wrong place? Think UltraDNS.com, GeoTrust.com, IPSCA.com, et cetera, as potential "accident victims". Unverified MAIL-FROM auth. Broken PGP auth. Keeping expired domains. Claiming they own domain names, and allow customers to use them as a "service". Redirecting the InterNIC neutral site to themselves. $150 during the domain "holding period". The Domain Registry of America scam. The CA screwup. The current DNS wildcard scandal. What's next? Looking at NetSOL's track record, I'd say they're unfit to provide the services they claim to. I also believe the Dept of Commerce threatened to revoke NSI's registrar privileges during the InterNIC homepage incident. Perhaps it's time to revisit this. Anyone with proper government or press ("domain service provider hijacks untold number of unregistered domains") contacts? Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

Detroit Area
by frank＠try-us.de 16 Sep '03

16 Sep '03

Hallo nanogers, someone out there in the Detroit Area ? Need some information about T1 connection and Watchguard reseller/partner. Please contact me off list -- Best regards, Frank Kuempel mailto:frank@try-us.de If it's there and you can see it - it's REAL If it's there and you can't see it - it's TRANSPARENT If it's not there and you can see it - it's VIRTUAL If it's not there and you can't see it - it's GONE

2 1

Re: What *are* they smoking?
by Kevin Loch 16 Sep '03

16 Sep '03

----- Original Message ----- From: "Patrick W. Gilmore" <patrick(a)ianai.net> Date: Monday, September 15, 2003 7:34 pm Subject: Re: What *are* they smoking? > > No, it accepts if the from domain exists - but only if it *REALLY* > exists. Anyone want to guess what happens to all those from addresses it captures?

4 4