full-disclosure - VeriSign's fake SMTP server for SiteFinder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030922203220.GC41987@sentex.net>
From: damian at sentex.net (Damian Gerow)
Subject: VeriSign's fake SMTP server for SiteFinder

Thus spake Richard M. Smith (rms@...puterbytesman.com) [22/09/03 16:24]:
> Does anyone know why Verisign has set up a fake SMTP server at their
> SiteFinder service to bounce email messages sent to misspelled or
> expired domain names?  The fake SiteFinder SMTP server gives the
> impression that it is a real SMTP server and happily accepts "To" and
> "From" email addresses before rejecting a misdirected email message.  

So mail doesn't sit in queues across the world, trying to contact them.

> I don't quite understand what technical issues Verisign is trying to
> solve here with a fake server.  Any guesses?

To provide something that is (more) RFC compliant.  The message before
responding with a 220 to your first two commands, and a 500 to your third
command.  So you could do:

    < 220 Snubby
    > I like monkeys
    < 220 Okay
    > Do you like monkeys?
    < 220 Okay
    > But I like chimpanzees better.
    < 550 Relay access denied

(I don't remember if that was the actual text, but you get the point).

They've since installed a Postfix server that at least understands SMTP, and
rejects at the proper spot.  It's still RFC-broken, however (doesn't accept
postmaster@), and it bounces mail for legitimate domains (a side effect of
the way Verisign implemented their wildcards).

  - Damian