[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <8B32EDC90D8F4E4AB40918883281874D9BE0@pivxwin2k1.secnet.pivx.com>
Date: Tue, 16 Sep 2003 22:40:41 -0700
From: "Thor Larholm" <thor@...x.com>
To: "Brian Hatch" <full-disclosure@...kr.org>
Cc: <list@...ield.org>, <bugtraq@...urityfocus.com>,
"NTBugtraq" <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>,
<full-disclosure@...ts.netsys.com>
Subject: RE: Verisign abusing .COM/.NET monopoly, BIND releases new
> From: Brian Hatch [mailto:full-disclosure@...kr.org]
> I hate to muck with a DNS server to fix this problem.
> And since I prefer DJBDNS, a BIND patch wouldn't do
> me any good anyway.
At least a BIND patch could be useful for ISP's running BIND or even be
reused in DJBDNS and similar.
> Is it always returning the same IP address, or have
> any other noticable characteristics? If so I'd think
> we could set up a firewall rule to drop all DNS
> replies that contain the Verisign-be-damned IP address.
> That'd protect everything, regardless of name server or
> method of access (using host/nslookup/etc manually.)
For now, it is returning the same IP address, but I have no trouble
imagining Verisign evading DNS filters by changing the A records every
now and then. Any solution to prevent Verisigns greed should keep this
in mind.
Dropping DNS replies would just result in repeated DNS queries, changing
the reply to NXDOMAIN as it originally would have been would be better.
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://www.pivx.com/larholm/unpatched - Unpatched IE vulnerabilities
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Powered by blists - more mailing lists