- Test - lists.nanog.org

Re: VeriSign SMTP reject server updated
by Michael.Dillon＠radianz.com 22 Sep '03

22 Sep '03

>before we deployed root-delegation-only here, i was also annoyed that my >e-mail tool could not tell me about misspelled domain names at "send" time >and i had to wait for the wildcard mail servers to bounce the traffic. In other words, Verisign is actually increasing the amount of misspelled domain name traffic by sabotaging the spell-checking feature of your email program. Under normal circumstances you would have noticed your error and corrected it before sending the email. This implies that Verisign could be collecting a much larger number of valid email addresses by logging these seemingly misspelled domain names and then "correcting" the misspelling by closest match against the .COM database. This would be an immensely valuable list for spammers to acquire, whether they do it by paying Verisign or by infiltrating the company to steal it. And don't pay any attention to Matt Larson's comments regarding logging. If he is unable to shut off the wildcard redirection then he has no say over what data is collected and what is done with it. Verisign could easily reassign him with a promotion and then turn on the logging and collection of email addresses. We already know that this company is unscrupulous and not to be trusted. In future we need to ensure that the registry operating the .COM domain works under some sort of contract that controls how they function. This is a public resource that we ourselves have created and not a commercial asset to be milked for profit. --Michael Dillon

1 0

Re: When is Verisign's registry contract up for renewal
by Brandon Butterworth 22 Sep '03

22 Sep '03

> DNS piracy is DNS piracy if Verisign gets away with it others will have a go too brandon

1 0

Home Storage Area Network security
by Sean Donelan 22 Sep '03

22 Sep '03

I received a few comments about file servers not serving files by default. There are a bunch of home SAN products on the market. They are designed to make it very easy for customers to set up and use a home storage area network. I think these are very cool products, and although some geeks like building stuff from scratch, other folks like buying stuff assembled and working out of the box. But they seem very dangerous when connected directly to the open Internet without some access control turned on. Instead they "assume" there will always be a secure firewall in place, protecting the devices. But in all the discussion about how secure their products are, you rarely see an explicit requirement for these SAN devices to be installed behind a firewall. Just because you use Linux does not make SMB secure on the Internet. http://www.mirra.com/ Ease of Use: Just plug in Mirra, run the installer, and let it auto-detect your network settings. Name your Mirra, say .ok. to the recommended backup set (or select your own), then forget it. Remote access is simple to use as well. No IPs to configure, no firewalls to penetrate. Mirra does it for you. http://www.martian.com/howtouseit.html The NetDrive comes pre-configured from the factory, so you don't have to worry about reading a long manual or learning about setting up file serving software. Of course, if you do want to enable password protection for your files or use a special network configuration, the NetDrive's simple web-based configuration interface will let you. What protocols does it serve files under? The NetDrive uses the standard SMB protocol to share its files. This makes it compatible with Windows PCs, Macs running OS X, and Linux boxes.

4 5

Re: When is Verisign's registry contract up for renewal
by Paul Vixie 21 Sep '03

21 Sep '03

> > > website: www.alt-servers.org. > > > > what a BAD idea. worse than anything else on the table or in > > existence today. > > Splitting the root you mean? I'm not sure there was enough info on that > site to come to any other conclusion, but I wanted to make sure. this is just dns piracy, dressed up in a morality play. it won't hold.

3 2

If Verisign *really* wants to help ...
by Lyndon Nerenberg 21 Sep '03

21 Sep '03

The logical follow-on to IP-based Sitefinder is SS7-based Phonefinder. I propose we redirect all "not in service" telephone numbers to Verisign's CEOs direct telephone number. --lyndon NT as a file server is faster than a dead bat carrying Post-It notes underwater. But not by much.

7 6

RE: When is Verisign's registry contract up for renewal
by Mike Damm 21 Sep '03

21 Sep '03

This sort of not-for-profit is exactly what I proposed when the VeriSign discussion started. A non-technical response to a non-technical problem. Since my inital email, I've recruited a few other NANOG folks and put up a website: www.alt-servers.org. -Mike (Please excuse any formatting oddities, sent via OWA) -----Original Message----- From: Jared Mauch To: Henry Linneweh Cc: Paul Vixie; nanog(a)merit.edu Sent: 9/21/2003 12:28 AM Subject: Re: When is Verisign's registry contract up for renewal On Sat, Sep 20, 2003 at 11:23:04PM -0700, Henry Linneweh wrote: > My view would concur with this, these are really old battles starting back in the > netsol days and now the verisign has taken the same short sighted path. > > It is time that neutral party is in charge > -Henry R Linneweh I was thinking this earlier this week. This is a public-trust that should be operated by people whose sole job is to keep it up and working, not by a dual-role entity as it is today. Perhaps we can get someone to make a not-for-profit for this sole role. - Jared > Paul Vixie <vixie(a)vix.com> wrote: > > > > ICANN can seek specific performance of the agreement by Verisign, or > > > seek to terminate Verisign's contract as the .COM/.NET registry operator > > > and transfer the operation to a successor registry. > > > > Quiet honestly I'd like to see all of the GTLD servers given to neutral > > companies, ones that ARE not registrars. [...] > > frankly i am mystified as to why icann awards registry contracts to > for-profit entities. registrars can be for-profit, but registries should > be non-profit or public-trust or whatever that specific nation's laws allow > for in terms of requirements for open accounting, uniform dealing, and > nonconflict with the public's interest. > -- > Paul Vixie -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

5 4

Quantifying SiteFinder Traffic
by gnulinux＠pacinfo.com 21 Sep '03

21 Sep '03

http://www.alexa.com/data/details/traffic_details?q=&url=verisign.com [full post mirrored from Interesting People] Date: Sat, 20 Sep 2003 18:54:28 -0400 To: ip(a)v2.listbox.com From: Dave Farber <dfarber(a)cs.cmu.edu> Subject: [IP] Quantifying SiteFinder Traffic >Delivered-To: dfarber+(a)ux13.sp.cs.cmu.edu >From: "Ben Edelman" <edelman(a)law.harvard.edu> >To: "'Dave Farber'" <dfarber(a)cs.cmu.edu> >Subject: Quantifying SiteFinder Traffic >Date: Sat, 20 Sep 2003 12:44:30 -0400 >X-Mailer: Microsoft Outlook, Build 10.0.4510 >Importance: Normal > >Dave, > >IP readers may be interested in a sense of just how much traffic VeriSign is >receiving from its SiteFinder service. Alexa, with its Alexa Toolbar and >associated traffic tracking services, makes it easy to find out: > ><http://www.alexa.com/data/details/traffic_details?q=&url=verisign.com> > >The highlights -- > >Over the past three months, taken as a whole, Verisign had traffic rank >1,559. But today its traffic rank is 19 -- meaning, at least among Alexa >users (who are generally representative of web users), the verisign.com >domain has suddenly become joined the top 20 sites, measured by page views. > >VeriSign's climb is even more notable when reckoned in "reach" -- proportion >of users who visit the site at least once. Measured in this way, >verisign.com is now in position 9 -- meaning there are only eight sites on >the web that more users visit in a given day. > >All that said, users don't tend to stay on verisign.com for long. Notice >page views rank of 45, far below the traffic rank, meaning that users tend >to stay on other sites for a longer duration (more page views) than on >verisign.com. > > >Ben Edelman >Berkman Center for Internet & Society >Harvard Law School >http://cyber.law.harvard.edu/edelman

1 0

Re: Verisign abusing .COM/.NET monopoly, BIND releases new (fwd)
by doug＠safeport.com 21 Sep '03

21 Sep '03

I have not tried this but After reading Paul Vixie's recent comments I intend to do so. _____ Douglas Denault doug(a)safeport.com Voice: 301-469-8766 Fax: 301-469-0601 ---------- Forwarded message ---------- Date: Wed, 17 Sep 2003 18:19:32 -0400 (EDT) From: Damaged Industries <damaged(a)damaged.no-ip.com> To: bugtraq(a)securityfocus.com Subject: Re: Verisign abusing .COM/.NET monopoly, BIND releases new On Wed, 17 Sep 2003, SR wrote: > > This is simply amazing, Verisign has just turned the .COM and .NET TLD > > DNS servers up-side-down for their own economical gain and, in doing so, > > disrupted network traffic for most of the Internet. Mail administrators > > who use any non-existant DNSBL to mark email as spam suddenly has all > > their mails deleted, people using localhost.localdomain.com on their > > servers for administrative purposes are scrambling to find out the cause > > of their problems and DNS problems arise everywhere as neg caching is > > essentially disabled and all DNS caches have to cache each and every > > randomly typed DNS query. > > > > The BIND patch that prevents this should be released Wednesday. > > djbdns already has a patch (make that two patches). > > They are available from djbdns.org > Several patches have been out: Bind9 patch: http://www.isc.org/products/BIND/delegation-only.html Bind8 patch: http://achurch.org/bind-verisign-patch.html Djbdns patch: http://tinydns.org/djbdns-1.05-ignoreip.patch PowerDNS patch: http://www.imperialviolet.org/binary/powerdns.patch Userfriendly :) http://ars.userfriendly.org/cartoons/?id=20030917&mode=classic ---- -- damaged

1 0

Re: Providers removing blocks on port 135?
by Mike Tancsa 21 Sep '03

21 Sep '03

Yes, this is all too familiar. Luckily it was not so acute for us. The porn company in question was using legit credit cards and we knew where they were located. We too got to the point where I had to contemplate blocking dialups with no ANI as I had already blocked all access from their phone numbers. However, once they started doing that I called up their office yelling and screaming law suits and I guess they figured there were other ISPs that didnt care as much and moved on to them. ---Mike At 10:39 PM 20/09/2003, jlewis(a)lewis.org wrote: >At one time, signing up for "throwaway dial-up accounts" was a common >spammer MO. We got hit a couple times, and they were like a plague of >vermin [the spammers]. They'd sign up giving us bogus contact info and a >freshly stolen (active) credit card. When the account was activated, >they'd dial in using half a dozen or so lines and pump out as much spam >(direct-to-MX) as they could. The really annoying bit is, we'd terminate >them, they'd call right back, and sign up again, giving different bogus >info and card numbers. We'd block them by ANI, and they'd block caller-ID >when calling us. I ended up being forced to block access to some of our >dial-up numbers both by ANI, and if there was no ANI, and then had to >setup exceptions for a few customers in those areas who we never got ANI >for. When I tried getting police in their areacode to investigate, they >had no interest/were too busy...even though I could give them phone >numbers the accounts were used from and stolen credit cards. > >To put a little operational spin in here...how many of you run dial-up >networks where you refuse logins unless you get ANI?...and if you do this, >do you also maintain an ANI blacklist? > >Anyway...they moved on to proxy abuse, then outright theft by creating >their own proxies on compromised MS Windows boxes. Both methods have the >advantage of totally hiding the spammer from the recipients and bandwidth >amplification. I imagine you could utilize multiple spam proxies on >broadband connections pumping out your spam while connected via dial-up >yourself. > >If you look at the numbers at http://njabl.org/stats, about 5% of the >hosts that have ever been checked are currently open relays (or nobody's >bothered to remove them). IIRC, at one point, this was nearly 20%. >13.6% are open proxies...and the disparity is definitely still growing, >with about 10x as many open proxies as relays being detected daily. >Unfortunately, the new breed of purpose-built spam proxies are generally >not remotely detectable, so the proxy percentage would be even higher if >it included the newer spam proxies. > >---------------------------------------------------------------------- > Jon Lewis *jlewis(a)lewis.org*| I route > Senior Network Engineer | therefore you are > Atlantic Net | >_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

Are Wildcards another Y2K?
by Kevin Loch 21 Sep '03

21 Sep '03

One thing that Y2K taught us was that programmers do some really stupid things with hard coded "this should never occur naturally" values. The year '99' was used to trigger all kinds of interesting things like erasing backup tapes, destroying inventory and worse. It is not implausible that someone has hard coded an "asdfjlkl.com" type domain somewhere important. The effects of such errors are not always immediately visible as they were with the spam filters. The problem is that the COM zone is part of the largest legacy software system the world has ever seen. Configuration changes to it affect virtually every application that uses DNS. How many lines of code is that? Hundreds of millions? Billions? Any configuration change to the legacy zones should be made only after careful consideration, with a strong prejudice to do nothing. Because V$ is downplaying the seriousness of this problem, many (most) won't audit their systems to see how it might be affected by this. I hope V$ is prepared to take responsibility for whatever breaks. I hope DOD/FBI/DHS aren't expecting a stable COM zone. I guess we'll find out the next time a terrorist buys a plane ticket or 1000 lbs of fertilizer using a bogus email address. KL

1 0