Subject: [Asrg] Verisign: All Your Misspelling Are Belong To Us

From: Brad Knowles <[email-masked]>
Date: Tue, 16 Sep 2003 03:10:52 +0200

Folks,

	This was just posted to the NANOG mailing list.  There are 
already people who are working on hacking BIND to return NXDOMAIN for 
wildcard records in TLD zones, or perhaps for any reference to the 
specific IP address(es) they are using (so far, we only know about 
64.94.110.11).  Meanwhile, many are already null-routing this IP 
address.

	This affects us, because now anyone can send spam with an address 
like "[email-masked]", 
and yet still have that pass standard anti-spam checks like "Does 
this domain really exist in the DNS"?

	Another one for the service provider BCP, I think.

	Anyway, the full message announcing this "enhancement" is:

>Date: Mon, 15 Sep 2003 19:24:29 -0400
>From: Matt Larson <[email-masked]>
>To: [email-masked]
>Subject: Change to .com/.net behavior
>
>
>Today VeriSign is adding a wildcard A record to the .com and .net
>zones.  The wildcard record in the .net zone was activated from
>10:45AM EDT to 13:30PM EDT.  The wildcard record in the .com zone is
>being added now.  We have prepared a white paper describing VeriSign's
>wildcard implementation, which is available here:
>
>http://www.verisign.com/resources/gd/sitefinder/implementation.pdf
>
>By way of background, over the course of last year, VeriSign has been
>engaged in various aspects of web navigation work and study.  These
>activities were prompted by analysis of the IAB's recommendations
>regarding IDN navigation and discussions within the Council of
>European National Top-Level Domain Registries (CENTR) prompted by DNS
>wildcard testing in the .biz and .us top-level domains.  Understanding
>that some registries have already implemented wildcards and that
>others may in the future, we believe that it would be helpful to have
>a set of guidelines for registries and would like to make them
>publicly available for that purpose.  Accordingly, we drafted a white
>paper describing guidelines for the use of DNS wildcards in top-level
>domain zones.  This document, which may be of interest to the NANOG
>community, is available here:
>
>http://www.verisign.com/resources/gd/sitefinder/bestpractices.pdf
>
>Matt
>--
>Matt Larson <[email-masked]>
>VeriSign Naming and Directory Services
-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Tue, 16 Sep 2003 03:24:18 +0200

At 3:10 AM +0200 2003/09/16, Brad Knowles wrote:

>  	This was just posted to the NANOG mailing list.

	Sorry, I just realized that I posted this with a subject line 
that did not follow the naming convention.  Now corrected.

---

From: Richard Rognlie <[email-masked]>
Date: Mon, 15 Sep 2003 21:32:12 -0400

for the sendmail crowd, I've got a milter to check for a return IP of
127.0.0.1 or 64.94.110.11 in the env-from addr.

    ftp://ftp.gamerz.net/pub/mxmilter.pl

I like the bind hack better.  but it'd take time to get the word out
on that...

Richard

-- 
 /  \__  | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey
 \__/  \ | http://www.gamerz.net/rrognlie/    <[email-masked]>
 /  \__/ | I can only please 1 person per day.  Today is not your day.
 \__/    | Tomorrow doesn't look good either.

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Sep 2003 01:26:23 -0400

PLEASE BE ADVISED THAT VERISIGN IS OPERATING AN SMTP SERVER AT THAT 
ADDRESS. The SMTP server appears fake, take a look at the following 
transaction:

----snip---
open 64.94.110.11 25
220 snubby1-wceast Snubby Mail Rejector Daemon v1.3 ready
blahblahbla
250 OK
blahblahbla
250 OK
blahblabhjla
550 User domain does not exist.
blahblbjhbj
250 OK
blajbjbjb
221 snubby1-wceast Snubby Mail Rejector Daemon v1.3 closing transmission 
channel

Connection to host lost.
----snip---

Brad Knowles wrote:

> Folks,
> 
>     This was just posted to the NANOG mailing list.  There are already 
> people who are working on hacking BIND to return NXDOMAIN for wildcard 
> records in TLD zones, or perhaps for any reference to the specific IP 
> address(es) they are using (so far, we only know about 64.94.110.11).  
> Meanwhile, many are already null-routing this IP address.
> 
> like "[email-masked]", and 
> yet still have that pass standard anti-spam checks like "Does this 
> domain really exist in the DNS"?
> 
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Sep 2003 01:32:34 -0400

One more piece of info from this post 
(http://www.merit.edu/mail.archives/nanog/2003-01/msg00050.html):

-----snip------

"They get back no MX, but an A record, pointing to this farm.  Most
mail servers will go ahead and try the A record, getting connection
refused.  The mailer will keep retrying for several days, all the while
these backing up in the queue."

Suppose you're a corporation, and a customer or prospect mistypes the
domain in the email address. Instead of failing immediately, the mail
server will keep trying to deliver that mail potentially for a week,
before ultimately being deemed non-deliverable. The client will be
confused, thinking your mailserver is down, or that you're ignoring
them, or that you're a terrible company and should take your business
to a competitor who is more responsive (and they might miss the
"bounce" message a week later, caught by their spam filters perhaps,
whereas they would have noticed the bounce had it been immediate). Not
a great "user experience".

Many of those "spam traps" which contain bogus email addresses will
start taking 7 days to fail, instead of failing immediately. Some ISPs
better get larger hard disks and connectivity budgets....
-----snip------

Yakov Shafranovich wrote:

>> and yet still have that pass standard anti-spam checks like "Does this

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Sep 2003 01:32:52 -0400

One more piece of info from this post 
(http://gnso.icann.org/mailing-lists/archives/ga/msg00311.html):