Resolving Everything: VeriSign Adds Wildcards

DragonHawk writes "As of a little while ago (it is around 7:45 PM US Eastern on Mon 15 Sep 2003 as I write this), VeriSign added a wildcard A record to the .COM and .NET TLD DNS zones. The IP address returned is 64.94.110.11, which reverses to sitefinder.verisign.com. What that means in plain English is that most mis-typed domain names that would formerly have resulted in a helpful error message now results in a VeriSign advertising opportunity. For example, if my domain name was 'somecompany.com,' and somebody typed 'soemcompany.com' by mistake, they would get VeriSign's advertising." Read on below for some more information.

"(VeriSign is a company which purchased Network Solutions, another company which was given the task by the US government of running the .COM and .NET top-level domains (TLDs). VeriSign has been exploiting the Internet's DNS infrastructure ever since.)

This will have the immediate effect of making network trouble-shooting much more difficult. Before, a mis-typed domain name in an email address, web browser, or other network configuration item would result in an obvious error message. You might not have known what to do about it, but at least you knew something was wrong. Now, though, you will have to guess. Every time.

Some have pointed out that this will make an important anti-spam check impossible. A common anti-spam measure is to check and make sure the domain name of the sender really exists. (While this is easy to force, every little bit helps.) Since all .COM and .NET domain names now exist, that anti-spam check is useless.

VeriSign has published white papers about their implementation and also made some recommendations."

But...

[Anonymous Coward]

according to this [slashdot.org] "soemcompany.com" isn't wrong.

Strike Back with Poor Typing

[nightsweat]

As a Denial of Service Attack Iwill continue to manually type domain names and not take typing classes.

I oughta be able to bring em to their knees in a day or two.

Verisign just DDOSed itself

[diamond0]

Verisign just DDOSed itself by redirecting untold numbers of spam bounces to a single IP. Good job, guys!

Is it just me?

[Anonymous Coward]

Or is this a bit of a coincidence given story [slashdot.org]

sreb

Re:wonder of wonders

[Anonymous Coward]

It is not that bad. At least if you enter "Verisign sucks big donkey balls", two of the three first results are from Slashdot.

wahts the porelbm?

[yali]

For example, if my domain name was 'somecompany.com,' and somebody typed 'soemcompany.com' by mistake...

What do you mean, "by msiatke [slashdot.org]"?

I'd rather resolve to goatse.cx

[Anonymous Coward]

oh wait a minute....

no i don't.

Re:How can we undo this?

[Anonymous Coward]

Anyone have any information on whom to contact to put an end to this absurdity?

I think you mean Commander Taco. Or were you talking about that dns thing?

My Rights! My Rights!

[Alex Pennace]

Help!

VeriSign has taken over www.lksdjglkjdslkjg44.com! This infringes on my trademark, which I have been using since 21:31 EDT. Unless VeriSign transfers that domain to me, for free, I'll sue!

This is what happens Larry...

[MrPerfekt]

when you fuck an RFC in the ass. *baseball bat on car headlight*

But we can't hate them...

[ShawnD]

They are running Linux [netcraft.com].

Just a little humour...

Re:wonder of wonders

[mosch]

Actually, the verisign search seems to be pretty good. A search for FUCK VERISIGN [verisign.com] returns a slashdot article about verisign sending out deceptive domain renewal mail as the second result.

BANZAI!!! Self-DoS Attack of Ownage

[Cordath]

This is one helluva of a way to drum up traffic, so I'd be curious to know what kind of steroid-pumped uber-server and fat petabyte pipe they plan to run their site on. Personally, I suspect the ad page will be taken down by Verisign themselves when they smell smoke coming from the server room and see their sysadmin's running around naked on the front lawn while tearing out their hair and screaming "SWEET MOTHER OF SMEGMA, MAKE THEM STOP!!!".

Re:Agreement by typo.

[flatt]

3. COST OF THE VERISIGN SERVICES.
The Verisign Service(s) are provided to you free of charge.

I can't wait under they start charging for this wonderful service.

Re:Now let's see

[DA-MAN]

I believe you are looking for www.hotmale.com

WARNING, DON'T CLICK!

[Anonymous Coward]

That's not random--it's Welsh for "Commander Taco."

~~~

Type whatever you want...

[Ieshan]

Just type in any URL you don't think corresponds to an address, like www.googoogoogle.com. All the contact info will be on the bogus page that pops up.

Scuh a walircdd culod be used for good

[lplatypus]

Hinavg jsut raed the shoasdlt srtoy eeilnttd Can You Raed Tihs? [slashdot.org], I bigen to wnoder if the sirntg mthicang used by DNS is too sitrct. Sulery a pmueertd nmae culod be rtdcireeed to the ceorrct stie? Aslo, one suhold not be aoellwd to reeisgtr a doamin nmae wihch is a smlipe pimaureottn of an esxiintg dimoan name wtih the smae frist and last leettr.

Re:Verisign just DDOSed itself

[etcshadow]

You didn't hear it from me, but...

Go to any machine you have a login on and:

while true; do for i in 1 2 3 4 5 6 7 8 9 0; do wget -O /dev/null `head -c 30 /dev/urandom | perl -pe 's/[^a-zA-Z]//ig'`.com >& /dev/null & done; echo -n . ; sleep 1; done

If you don't have wget, be creative. Substitute curl, maybe. Or mail. They're totally asking for it.

Of course, I'm not *actually* advocating a voluntary distributed denial of service attack against this unbelievable bullshit. That would be irresponsible. Shame on anyone for thinking of it. ;-)

Re:Oh common, the workaround is so obvious...

[jaysones]

Akin to shooting themselves in the foot with a 45 caliber pistol; it's going to anger a lot of people in the IT industry.

I don't think a lot of IT people would be very upset if they shot themselves after this! :D

Re:Mail trap

[xdroop]

Quick, saturate web pages with hundreds or thousands of nonsensical email addresses -- we can dilute spammer's lists, _and_ flood verisign.

Everybody wins!

Oh great!

[jeeryg_flashaccess]

Tihs is all thanks to sldhsaot's sroty elirear today! Hree's a lnik jsut inacse

http://science.slashdot.org/article.pl?sid=03/09 /1 5/2227256&mode=thread&tid=133&tid=134&tid= 186

Re:Strike Back with Poor Typing

[Jeffrey Baker]

Ah, that does make sense. It also allows VeriSpam to harvest misspelled email addresses ;)

Drastic times call for drastic measures.

[pr0ntab]

Let's define reserved bit 3 in RCODE to be the "evil bit".

So if a patched named resolves a domain to an IP node on a DNS-tomfoolery blacklist, it returns 11 instead of 3, ie. FUCK_VERISIGN instead of NXDOMAIN.

libresolv on Solaris, glibc, etc. should be modified accordingly. Perhaps an environment variable determines the behavior: default is to map non-existant, of course.

Re:wonder of wonders

[morganjharvey]

No, the real fun is that if you misspell verisign like this:
http://www.veirsign.com [veirsign.com]
Looks like someone beat them at their own game. :)

Re:Strike Back with Poor Typing

[bigberk]

Seems like not answering to port 25 would fulfill all your mail rejection needs.

What are you, crazy? You're saying that if no service exists at an address then nothing should be returned? You obviously don't have a business degree and don't work for Verisign. Returning nothing would clearly waste valuable potential for new business.

Re:Complain to Verisign as well

[PD]

Very good, I just sent them this mail:

From: Patrick Draper <[e-mail]>
To: [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail]
Subject: Fix the Internet, you broket it!
X-SpamProbe: GOOD 0.0000000 3f0bd9f2ffff366c6e9e732ad3227480

Stop your silly games with the wildcard A records.

Love,

Patrick

--
Patrick Draper | Don't |[e-mail]
Austin, Texas | Fear |Father Order runs at a
http://www.pdrap.org | The |good pace, but old Mother
Be Microsoft Free - Use Linux |Penguin |Chaos is winning the race.

Here you go

[Anonymous Coward]

#!/usr/bin/python
import socket
x = 0
while True:
try:
x += 1
dns = "www." + "verisignsucks" + str(x) + ".com"
s = socket.gethostbyname(dns)
print dns, "resolved to", s
except: print "resolving", dns, "failed"

What's next?

[drx]

If you look for a file that doesn't exist on your hard drive, you will get ads for MS Office, telling you that you can create your own files with that!

Shocked...

[Anonymous Coward]

"I was shocked to discover that ome company actually tries to sell products on a website called 'www.fuck-children.com'"

Who are these verisign paedophiles anyway?

I feel a bit like Aurther Dent

[Ex Machina]

The plans have been on file for how long??? eeesh

Re:Complain to Verisign as well

[tulare]

Heh, the spambots are going to have a field day with your post. Good man.

verisign-sucks.net reaches them fine

[billstewart]

I tried some obvious alternate spellings for Versign's domain name, such as verisign-sucks.net, and they do reach that page. Verisign-sucks.com doesn't get there, but that's because somebody's already registered it....

Re:wonder of wonders

[cerberusss]

You bastard. You forgot to mention to put quotes around it. I looked up that sentence at a client and now they want my balls because the first zillion results returned pr0n sites.

Re:Which domains?

[Anonymous Coward]

You expected Verisign to fuck up the Internet correctly?

M$

[Anonymous Coward]

1. (optional) M$ buys Verisign secretly.
2. Verisign gets *.com & *.net.
3. sitefinder.verisign.com gets more hits than google.com.
4. Verisign switches to latest & greatest M$N technology.
5. Google is dead.

all your .com are belong to us

[Anonymous Coward]

all your .com are belong to us

Fun Stuff

[Speljamr]

Try this link: http://sitefinder.verisign.com/lpc?url='%3E%3Cfont %20size=+5%20color=%23FF0000%3EVERISIGNSUCKS%3C/fo nt%3E [verisign.com]

Put this in your crontab:

[pen]

0 * * * * lynx -dump http://www.verisignisevil.com/ > /dev/null