BugTraq
Privacy leak in VeriSign's SiteFinder service Sep 23 2003 09:04PM
Richard M. Smith (rms computerbytesman com) (2 replies)
GoDaddy vs Verisign Sep 25 2003 02:32AM
Scott Buchanan (scott buchanan axegroup com au)
Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 06:00PM
Mark Coleman (markc uniontown com) (3 replies)
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 07:45PM
der Mouse (mouse Rodents Montreal QC CA) (1 replies)
> Verisign does NOT reject the connection until AFTER the MAIL FROM:
> and RCPT TO: fields have been communicated by your email server.

The "server" they had completely ignored, as far as anyone could tell,
all input: you could type total garbage lines and get exactly the same
canned sequence of responses.

Note the past tense. Now, when I connect there, I get a 521
"greeting", from some host that apparently believes it lives in a new
TLD .11 (apparently not content with inventing new .com and .net names,
they've now invented a whole new TLD - at least this one they didn't
actually put in the DNS):

% telnet yyaahhoooo.com 25
Trying 64.94.110.11...
Connected to yyaahhoooo.com.
Escape character is '^]'.
521 64.94.110.11 Recipient domain does not exist
Connection closed by foreign host.

> They could (AND SHOULD) REJECT from the initial connection,

Actually, the wildcard shouldn't have been inserted in the first place;
when it was, .com and .net should have been immediately handed over to
a more ethical custodian. But Verisign doesn't seem willing to remove
the wildcard on their own (hardly surprising), and ICANN appears
unwilling to do more than scold (depressing, but not really surprising).

> Bad, verisign. Very bad.

Well, yes, but we knew _that_ from the day the wildcard went in.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse (at) rodents.montreal.qc (dot) ca [email concealed]
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

[ reply ]
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 08:58PM
Jay D. Dyson (jdyson treachery net)
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 07:26PM
Hugo van der Kooij (hvdkooij vanderkooij org)
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 07:00PM
Marco Ivaldi (raptor 0xdeadbeef info) (2 replies)
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 25 2003 09:37AM
Henning Rust (Henning Rust stud uni-hannover de) (1 replies)
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 25 2003 03:21PM
Niels Bakker (niels=bugtraq bakker net)
Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 08:05PM
Diego Bitencourt Contezini (diego redesul net)


 

Privacy Statement
Copyright 2010, SecurityFocus