Verisign break DNS

[manarth]

The Register says:

http://www.theregister.co.uk/content/6/32852.html

Verisign have added a wildcard entry to the .com / .net TLD DNS.
[ol][li] There is no longer any such thing as a non-resolving .com / .net domain.[/li]
[li] This compromises a fundamental method of anti-spam checking.[/li]
[li] This increases the complexity and required bandwidth for a robot crawler to identify non-operational links.[/li]
[li] The majority of internet users (May 2003: 93% -

http://www.thecounter.com/stats/2003/May/browser.php)

use Microsoft's IE5 browser or above, which already incorporates a search feature similar to Verisign's implementation.[/li]
[li] Patches have already been developed for various BIND implementations which deliberately ignore the wildcard response, and so introduce a level of inconsistency into the DNS system.[/li]
[li] Most importantly, this implementation contravenes the defined DNS standard: RFC1034:[/li][/ol]
// quote ( available from: ftp://ftp.rfc-editor.org/in-notes/rfc1034.txt ) //
If recursive service is requested and available, the recursive response to a query will be one of the following:

- The answer to the query, possibly preface by one or more CNAME RRs that specify aliases encountered on the way to an answer.
- A name error indicating that the name does not exist. This may include CNAME RRs that indicate that the original query name was an alias for a name which does not exist.
- A temporary error indication.
If recursive service is not requested or is not available, the non-recursive response will be one of the following:
- An authoritative name error indicating that the name does not exist.
- A temporary error indication.
- Some combination of:
RRs that answer the question, together with an indication whether the data comes from a zone or is cached.
A referral to name servers which have zones which are closer ancestors to the name than the server sending the reply.
- RRs that the name server thinks will prove useful to the requester.
// end quote //

Basically, when a client requests DNS resolution from a DNS server, the server uses either a recursive or non-recursive method of resolution. In either case, where the domain name does not exist, the expected response is 'an authoritative name error indicating that the name does not exist'. This is not the case with the current wildcard implementation.

Is verisign abusing it's trusted position for profit?

I see this as a fundamentally wrong move - any other thoughts?

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[dwarfthrower]

Oooh. A can'o'worms for sure. Greedily cybersquatting on domains they haven't paid for or providing a service? I tend to lean to the former opinion. What's to stop Verisign now gathering information on &quot;most commonly not-found&quot; domains and registering them with the intent of using them for some purpose or other. Not that they have any need to do that, but then - they don't really have any need to substitute their own site in place of a functioning error message either. It's almost like those little activeX browser add-ons that sometimes get dropped onto pcs that 'help' the user by redirecting them to search engines etc.

_{Never be afraid to share your dreams with the world.
There's nothing the world loves more than the taste of really sweet dreams.}

 

[chiph]

There was an announcement on Slashdot today that the next release of Bind will have an option to fix this new &quot;feature&quot;.

Chip H.


If you want to get the best response to a question, please check out FAQ222-2244 first

 

[pmonett]

I find that Verisign is very much becoming the ignorant bully that needs a long trip to the cooler.
They have consistantly been nailed for domain scams of all types, security inconsistencies by the dozens, breach of contract and price fixing.
This is but the next logical step in an attempt to glean a maximal profit with minimal responsibility.

Sometimes, I daydream of a county where weapon nuts going over the edge would go after high-profile CEOs guilty of abusing their power or making corporate decisions that go beyond the scope of the company, instead of school kids or professors or ordinary shoppers.
For example, a CEO guilty of raking in royalties instead of paying them out to artists, or one guilty of breaking down the core assets of a once-fine international computer and services company and using the money to buy jets, or even a CEO responsible for destabilising the Net instead of guaranteeing its security.
I'd sure have a lot more trouble hating the nut that whacked those guys.

Pascal.

 

[dwarfthrower]

At least they have a sense of humour:

http://sitefinder.verisign.com/lpc?url=linux&host=www.microsoft.com

_{Never be afraid to share your dreams with the world.
There's nothing the world loves more than the taste of really sweet dreams.}

 

[MasterRacker]

dwarfthrower, that's a good one.

This is definitley plain old greed at work. Needs to be stopped. Frank Hayes just wrote about this also:

http://www.computerworld.com/developmenttopics/websitemgmt/story/0,10801,85392,00.html

Jeff
If your mind is too open your brains will fall out...

 

[carrr]

FYI...

http://www.cnn.com/2003/TECH/internet/10/03/engine.typos.ap/index.html

 

[bcastner]

This is a very &quot;Inside the Beltway of Washington, DC&quot; view of things, but the current feeling is that there is nothing illegal in what Verisign did.

Not that something cannot be made up, but on its face they have a legal right to do so.

The other notion tied to this is that their charter is not in perpetuaty, and that if the consumer and technical community yell loud enough they will have to back off this change.

 

[sleipnir214]

carr:
Here's another link. Same story, different editing:

http://www.computerworld.com/news/2003/story/0,11280,85723,00.html

I particularly like the quote from Russel Lewis, executive VP of the Naming and directory services group: &quot;Without so much as a hearing, ICANN today formally asked us to shut down the Site Finder service. We will accede to the request while we explore all of our options.&quot;

To me, he comes across sounding petulant.


bcastner:
Back when Network Solutions (now a part of Verisign) for all intents and purposes owned .com, .net, etc., they might have gotten away from it.

Now, however, control of internet names and numbers has been turned over to ICANN. I doubt Verisign's contract with ICANN allows them to make such a fundamental change to two top-level domains without ICANN approval.



Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!