I'm sure everyone has heard about this already on sites like slashdot, but recently Verisign added a wildcard A record to the .NET and .COM domains, matching all unassigned domain names. Example:

#nslookup adsnklasdnjkasdnjk.com
Server:  some.server.dom
Address:  x.x.x.x

Non-authoritative answer:
Name:    adsnklasdnjkasdnjk.com
Address:  64.94.110.11

For the first few hours of it's life, that server hosted a Verisign-sponsored search engine, covered with adds, with results higly slanted towards Verisign and it's affiliates. The web server appears to be down, but it's still accepting SMTP connections, with a hardcoded response sequence of 220, 250, 250, 550, 220, <DISCONNECT>. A few other common ports are open with similar token reponses.

Understandably, this has angered quite a few people. In response, ISC has released a new version of Bind that allows administrators to block this response:

http://www.isc.org/products/BIND/delegation-only.html

The basic steps are:
-Upgrade to Bind 9.2.3rc2
-Add the following lines to your named.conf:
zone "com" {
        type delegation-only;
};
zone "net" {
        type delegation-only;
};
-start the new version of Bind.

Enjoy DNS as it was meant to be experienced.

-Brad


_______________________________________________ EuG-LUG mailing list [EMAIL PROTECTED] http://mailman.efn.org/cgi-bin/listinfo/eug-lug

Reply via email to