Notes from my terminal

More on Verisign's DNS Hijacking

Yesterday, domain registrar Verisign decided to hold the whole Internet hostage by manipulating the core of the Domain Name System (DNS). This is a horrible thing for at least two reasons:

1. DNS lookups are not possible any more. You cannot verify if a given domain is valid or not. This breaks spam detection tools (although I have my problems with spam detection based on network addresses). Dorkslayers RBL is already down. Worse yet, there's no way to tell if you made a mistake or not, as Verisign deliberately broke the RFC and doesn't return the usual NXDOMAIN record via UDP, but connects you to a real web site. If DNS confuses you, maybe an analogy that works might go like this: Imagine you want to make a phonecall, but you dial the wrong number. The phone company wouldn't play the usual recorded message, but rather connect you to a sales-agent who'd tell you that, yes, the number in question is wrong, but hey, you could register it for a small fee. Oh, of course you would have to pay for the call and the chit-chat with the agent.
2. By breaking DNS, Verisign invades your privacy and tries to read your e-mail. How? Well, it's often overlooked, but as a rule whoever messes with DNS, messes with the e-mail infrastructure as well. Verisign run a SMTP daemon on their site, listening on the standard port. This daemon currently rejects all e-mails it receives, but it's a piece of cake for Verisign to change that and store every Internet e-mail with a typo in the address in their database. Although there's no wildcard MX record by Verisign for unregistered domains, most mailers will happily deliver everything to the A record published. It's suspicious and alarming that Verisign felt the need to install a SMTP daemon on their catch-all host at all.

What can be done? Well, to work around Verisign's denial of service attack, both BIND and djbdns, two of the most widespread DNS resolvers, published patches. Can Verisign be stopped through ICANN? Doubtful. I agree with what former ICANN director Andy Müller-Maguhn told me in a brief telephone talk today: "ICANN will protest. Then they will look into the contracts they have with Verisign, they will find out that the contracts do not mention such a case and finally they will give up."
The situation is both nasty and dramatic and shows once again the monopolistic power Verisign posseses. Posted by jens at September 17, 2003 05:37 PM | TrackBack