full-disclosure - Re: Verisign abusing .COM/.NET monopoly, BIND releases new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030918015959.DJWH15705.lakemtao07.cox.net@winxppro>
From: rkingsla at cox.net (Rick Kingslan)
Subject: Re: Verisign abusing .COM/.NET monopoly, BIND releases new

Folks,

With total and complete respect for those offended by the morons at
Verisign, or the merely amused - 

I really wish that I had your problems if this is the biggest bitch of the
day....  I'll gladly trade.

;o>

-rtk

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Jose Nazario
Sent: Wednesday, September 17, 2003 4:19 PM
To: Thor Larholm
Cc: list@...ield.org; bugtraq@...urityfocus.com; NTBugtraq;
full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] Re: Verisign abusing .COM/.NET monopoly, BIND
releases new

a number of options exist to help you remedy this issue:

	- bind 9.2.3rc2 supports "delegation-only", stopping some
	  wildcard implementations from making any difference

if you simply want to stop traffic getting there (they are running a website
and a partially functional MTA on that IP):

	- you can BGP null route this
	  http://www.merit.edu/mail.archives/nanog/msg13715.html

	- cisco's NBAR functionality may be used to detect and block those
	  reply packets from coming in by looking for the response from
	  the nameservers.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121
limit/121e/121e2/nbar2e.htm

note that this wont stop the query from reaching verisign, it will just stop
you from going to that IP. however, for some enforcing network privacy
concerns, that may be worthwhile.

hope this helps,

___________________________
jose nazario, ph.d.			jose@...key.org
					http://monkey.org/~jose/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html