BIND Strikes Back Against VeriSign's Site Finder

BrunoC writes "Following the story about VeriSign's new Site Finder, the Internet Software Consortium promises to release a patch to its (in)famous BIND that will block the controversial Site Finder. Wired News has full coverage of the ISC initiative against this name resolving atrocity."

the patch

[colinleroy]

Isn't it this one [isc.org] ?
I'm asking because the wording is quite hard to understand as my main language isn't english ;)

Here is ISC's web page for delegation Only zones

[doon]

http://www.isc.org/products/BIND/delegation-only .h tml

Re:Yeah, only SPAM, sure.

[Anonymous Coward]

Actually, you do not get anything at the moment. 64.94.110.11 is currently not responding, no doubt under a deluge of requests. While this isn't such a big deal for those who have mistyped a domain name in their browser, it will certainly cause a hell of a problem for mailers around the globe. Remember that Verisign have set up "dummy" mailer deamons on port 25 to ensure mis-directed mail got bounced immediatly, rather than sit in the mail queue? Well now the mailers can't contact that dummy deamon, and the mail is building up in the queues.

I hope some large ISP's bring action against Verisign for breaking their email systems like that.

In the meantime, if you want to help keep Verisigns SiteFinder off the internet, try this simple script in a while loop:

#!/bin/sh
function get_char(){ local GOOD=0;while [ $GOOD == 0 ];do RAND_C="$(dd if=/dev/urandom bs=1 count=1 2>>/dev/null)";if [ $(echo "$RAND_C" | grep [0-9A-Za-z]) ];then GOOD=1;fi;done;};function get_string(){ local INDEX=0;while [ $INDEX != 32 ];do get_char;RAND_STR[$INDEX]=$RAND_C;let INDEX++;done;};get_string;URI=$(echo "${RAND_STR[@]}" | tr -d ' ');wget -O - $URI.com >>/dev/null 2>>/dev/null;exit 1

Re:Bug your ISP

[insomaniac]

Well, windows dns, maradns, powerdns... etc etc.

Or they are like me and use djbdns, and won't go back.. ;)

There is a patch for djbdns, but they're not official so I wouldn't reccomend blindly using them.

Re:Bug your ISP

[superpeach]

Or if you get bored you could try dnsmasq [thekelleys.org.uk] and block the sitefinder yourself. As of yesterday dnsmasq has had the option to return NXDOMAIN when it recieved the 64.94.110.11 address (or any others you choose)

Re:very cool.. dnscache?

[Torne]

Yep, the patch for dnscache by veteran Russ Nelson is here:
tinydns.org/djbdns-1.05-ignoreip.patch [tinydns.org]

Re:Bug your ISP

[doon]

We are a bind shop, But I know othesr that run

• TinyDNS [cr.yp.to]
• Power DNS [powerdns.com]
• NSD [nlnetlabs.nl]

Really depends on if you need a Recursive Caching server or just an Authoritive Server.

Patches

[achurch]

Patches for DJBDNS and lots of other daemons here [imperialviolet.org].

link to patch and example

[jcurious]

upgrade can be found here:
http://www.isc.org/products/BIND/delegation -only.h tml

There is no need to create a com or net data file. Just the
entries to the named.conf file is enough
zone "com" { type delegation-only; };
zone "net" { type delegation-only; };

Ofcourse, if you use views, this needs to be provided within the relevant
view (the one performing recursive lookups).

quote from:
http://marc.theaimsgroup.com/?l=bind9-users &m=1063 79587928771&w=2

Re:How will this work?

[close_wait]

I assume the patch will filter requests, which resolve to the site-finder IP, so what's to stop VeriSign simply changing IPs every so often?

No, the patch doesn't do filtering in that sense. It just allows you to mark some zones in your BIND config file (such as .com and .net), that should only contain delegation information. So basically if your BIND server recieves back A record(s) rather than NS delegation records from a server authoritative for .com , BIND simply ignores it.

Simple and elegant, and nothing Verislime can do about it. (I hope.)

For TinyDNS / dnscache users

[pgregg]

Russell Nelson has a patch [tinydns.org] for tinydns [tinydns.org] which does the same thing.

He also notes that several other TLD operators for the same thing and has another patch [tinydns.org] that allows you to do the same thing to several naughtly tld operators at once.

The new versions of BIND are already available

[Raphael]

Although the news are not on the BIND page [isc.org] yet, patches for the current versions 9.2.2 and 9.1.3 are already available. Only 9.2.3rc2 is currently listed on the page (as of this writing).

You can get the details from the bind-announce list archives:

• 9.2.2-P1 [theaimsgroup.com]
• 9.1.3-P1 [theaimsgroup.com]
• 9.2.3rc2 [theaimsgroup.com]

All versions were released a few hours ago. Here is the common paragraph at the top of these three messages:

In response to high demand from our users, ISC is releasing a patch for BIND to support the declaration of "delegation-only" zones in caching/recursive name servers. Briefly, a zone which has been declared "delegation-only" will be effectively limited to containing NS RRs for subdomains, but no actual data outside its apex (for example, its SOA RR and apex NS RRset). This can be used to filter out "wildcard" or "synthesized" data from NAT boxes or from authoritative name servers whose undelegated (in-zone) data is of no interest.

Have fun downloading and installing!

Re:very cool.. dnscache?

[richard-parker]

Does anyone know how to do this with DJBDNS?

A list of patches for various name servers can be found here [imperialviolet.org].

Unfortunately the djbdns patch at that URL is not as elegant as the official patch from ISC for BIND. Unlike the ISC BIND patch, the djbdns patch does not support the declaration of "delegation-only" zones. Instead, it adds support for the rather crude technique of converting an A record response containing an operator specified IP address (which you would currently set to 64.94.110.11) into a NXDOMAIN response.

Re:Soundex into BIND!

[Xner]

Interesting, but that is so far outside the problem domain that it's not even funny.
Bind should just return NXDOMAIN and the application (Mozilla, IE, BitchX, whatever) can then sort it out in this fashion. Hell, we can even make handy BSD-licensed shared libraries that do this for easy integration.

The matter is that the application must be informed when a domain does not exist, not spammed with guesses that may be right.

Re:Soundex into BIND!

[joshv]

BIND should be enhanced in several ways:

The most important one, IMHO, is to compute a list of close matches and present these choices to the user. They may use the Soundex algorithm or some other tricks to see if characters are transposed, if one characters is wrong, if one is missing, etc. If well implemented, this would solve 60% of the problem.

BIND (and other Domain Name Servers) are given the simple task of turning a string into set of 4 octets (aka an IP address), using a massively distributed lookup table that maps strings to IP address.

The reason people are pissed off about Verisign's wildcard entry is that they have depended on their DNS saying "I can't find an IP address" when it can't find an IP address.

In general BIND is a program that talks to other programs via a very stable and well understood interface. Now, how would enhance BIND to do a soundex and return multiple possible results to programs that have been written to expect either a response in the form of a single IP address, or a "domain not found" error?

Sounds to me like this is something that should be handled in the application, if at all.

-josh

Re:The new versions of BIND are already available

[boojit]

And here's a helpful posting [theaimsgroup.com] on how to use the new patch.

DaC

Re:Lot of fuss about nothing

[Anonymous Coward]

We're not talking about you and your little web browser, we're talking about a major network provider breaking an important network infastructure component in a way which has already started to cause havoc across the internet. At the moment, the server they are using as a catch all is not responding to connections, which means that there "clever" solution to handle mis-directed email doesn't work. As a consequence, mis-directed mail has already started to pill up in mail queues while mail servers waste their time trying to contact the Verisign server.

Other services are also shit out of luck; Verisign only allowed for HTTP and SMTP. Anything else trying to connect to a non-existent domain is out of luck and will sit around until the connection timesout. Of course, if the server had just returned NXDOMAIN in the first place, as it should, you wouldn't have that problem.

I am glad you're not patching

[Anonymous Coward]

Were I coding this patch, for example, the IPs for which to return NXDOMAIN would be specified in a config.

And what good would that do? If VeriSlime changes the ip hourly, you'd have to edit the config file hourly: bwilliant patching Holmes.

I prefer the patch as it will be supplied by the ISC: Patch bind and add the following snippet to named.conf:

zone "com" { type delegation-only; };
zone "net" { type delegation-only; };

Tada. Let VeriSlime work around *that*.

Re:Soundex into BIND!

[Lozzer]

DNS is a directory service for god's sake, not a god damn search engine.

Right

DNS maps domain names to IP addresses and vice versa, nothing more

Wrong [dns.net]

Re:How will this work?

[close_wait]

That approach is fucking dangerous.

Why? Glue records. You are _meant_ to receive certain As from the parent servers of a domain delegated to nameservers which live within its own namespace.

But glue records are very specific, and can be easily checked for. Only if an A record matches one of the names in the NS records need it be kept.

Re:hmmm don't want to be alarmist

[Anonymous Coward]

but couldn't this be the thin end of the wedge towards technologically mediated censorship?

Nope, no chance of that. You hace to actively define the zones for delegation-only.

From a post by Paul Vixie [merit.edu]:

> And make it default configuration for new bind releases...

never. not for your example, nor for any set of tld's. the default for
bind will be what it's always been -- to respect the autonomy of the
zone administrator/publisher. overriding that autonomy has to be a
local act by a local name server administrator who is fully conscious of
the impact of their configuration change. once, with "check-names", isc
was accused of "legislating from the bench". never again.

Re:What about the other 20%?

[hkmwbz]

Read the discussion: 80% runs BIND, what runs on the remaining 20%? [slashdot.org]

Re:Good for BIND

[Insurgent2]

No, they don't dare do this.
It's a federal offence to redirect a misspelling to a porn site as it's "illegal to deceive children into viewing harmful material". This is a provision of the "Amber Alert" legislation and will land you in jail for 4 years.
Relevant Link [geek.com]

Re:ISC ROCKS

[hephro]

If BIND decided to distribute a seperate set of root servers in a cache file and enough ISPs used it the Internet DNS system as we know it today could change overnight. ;-)

The root servers do not serve .com & .net. What you'd want is that they delegate .com & .net to somebody != Versign, but that's decision that is up to IANA and Paul Vixie and others have made it clear on nanog that their root servers will not go against IANA.

Moreover, alternative root servers would have to delegate .com & .net to some other trusted(?) party...

Re:Yeah, only SPAM, sure.

[Ryosen]

I have to make a small complaint here. I don't seem to be able to get the sitefinder page when I enter in an unregistered domain name. Not the links above nor just random garbage. I merely get a "Could Not Connect to Remote Server" message.

*Sigh*. I never get to have any fun...

Re:But for how long

[interiot]

Here [isc.org] is the documentation for the patch. They don't hardcode an IP, they just have a way to say that wildcards records don't necessarily have to work everywhere. eg. you can say that "*.foobar.com => 1.2.3.4" but you can't say that "*.com => 64.94.110.11".

Re:could NOT care less you idiot

[tsvk]

What irritates me more is when people refer to junk email as "SPAM" instead of "spam"

actually, isn't that part of hormel's deal? we can continue to call UBE (insert full stops as required) SPAM as long as we capitalise it and they won't complain or try to sue anyone over dilution of trademark etc. (ie as spam is actually a product they sell).

It's the other way around. Hormel has a trademark on 'SPAM' and would prefer UBE to be called 'spam'. See the SPAM website [spam.com] for more info.

Re:Have your say

[turg]

Scroll down, there are multiple polls on the same page.

Re:How will this work?

[Paul Jakma]

That approach is fucking dangerous.

Why? Glue records. You are _meant_ to receive certain As from the parent servers of a domain delegated to nameservers which live within its own namespace.

However, you're missing a crucial part: when you ask the delegating server for the NS records, the glue A records are given out in the additional section, not in the answer section.

The ISC patch disregards /authoritative/ non-apex data from zones configured as delegate only. however, it can still make use of additional data (ie glue). Glue records are never queried directly AFAIK when a DNS server is sending queries to determine the set of authoratitive servers for a zone, so the patch does not cause any problems.

Re:Lot of fuss about nothing

[Felinoid]

What your not aware of is that about the same time Microsoft inserted it's own "helpful" page instead of what the remote server sent web admin realised the value of using the servers own internal feature of sending a more helpful page.

The internal 404 usually is some sort of program to track down and redirect you to where you should be so instead of saying "This page no longer exists" it's saying "Hay maybe you want THIS page instead."

Also read the 404 page more carefully. If something has gone wrong with the website your given contact information (presumming the web admin did his job and put the admin contact e-mail into the server) in the 404 message so that you can contact the person or persons responsable for maintanence and tell them what went wrong.

But again you won't get that contact information under Microsoft Windows IE "helpful" page.

That page is IEs best guess as to what happend and being familure with the Internet I'm usually aware of what is wrong and what is really going on and quite frankly IE has yet to guess the real cause of the 404 message.

However the big diffrence between Microsoft IEs replacement "Hay quit complaining I'm only trying to help" and Verisons search website is that IE is on YOUR computer and if you don't like how IE works download Netscape, Opra, Mozilla or one of the many other web browsers that are out there and you get the REAL 404 message but Verison is basicly changing the Internet inferstructure to do this so we all get screwed reguardless of the programs and os we use.

Re:Lot of fuss about nothing

[j7953]

MSIE has been doing this for ages, and I never found it to be a problem, but rather more helpful than the old "404 Not found" messages we used to see.

You don't get to see a "404 No Found" response if the server doesn't even exist. You'd usually get an error message (generated by IE) that says something like "www.invaliddomain.com doesn't exist." (that's what Mozilla displays, I don't know IE's message).

The 404 response is what you get when your browser could send a HTTP request to the web server, but the server couldn't find the page you were requesting. The response page is generated by the web server, so how helpful it is depends on what the web server admins have configured. Some pages will not simply return an error message but also include a search box, for example.

You type junk into an URL and you expect a civilized answer?

Well, yes, I expect a somewhat helpful error message. But that's not actually the point. The main problem with Verisign's move is that they are assuming (like you seem to do) that the purpose of the Domain Name System is to find the web server that a user is trying to contact when he types an URL into his browser. But DNS isn't used for the web only, it is used to associate names with IP addresses. You can then use the returned IP address for whatever protocol you want, DNS doesn't tell you whether or not the server with the returned IP supports that protocol.

For all protocols that run non-interactively (i.e. without a human sitting in front of the computer and interactively deciding what server should be contacted next, and interpreting the responses), Verisign's action means that if contacting a remote system fails, the computer can now no longer find out if it's due to a misconfiguration and will likely never work (if the other computer doesn't exist), or if it's just a temporary problem (if the other computer does exist but does not respond).

Re:very cool.. dnscache?

[Russ Nelson]

Even better is the version I wrote last night, which lets you ignore a list of names. [tinydns.org]
names.tinydns.org/djbdns-1.05-ignoreip2.patch.
-russ

For Windows Users

[www.microsoft.com]

Edit file "C:\WINNT\system32\drivers\etc\hosts" (/etc/hosts for any real OS)and add

216.239.51.99 sitefinder.verisign.com

216.239.51.99 can be any IP.
216.239.51.99 is Google.com.

OK, it's not strictly regulation, but with any luck Verisgn will find that "controlling" the underlying technology of the Internet is not as easy as they first though
Yes, Google is in control.

It bears repeating

[mr.nicholas]

I'm sure it's been mentioned before, but for those of you who run their own DNS servers, there is an extremely easy way to set yourself up to use OpenNIC as an alternative root.

Simply locate your "root.servers" file (/var/named for RedHat installations) and run:

dig @131.161.247.226 > root.servers

and restart named. To verify that things are then working correctly:

> host ns0.opennic.glue
ns0.opennic.glue. has address 131.161.247.226

From that point onwards, you can update your root server file by adding something like this to your weekly cron: /usr/bin/dig @ns0.opennic.glue > /var/named/root.servers

Easy!

[bisho]

while true;
do
echo VerisignSucks${RANDOM}Times.com \
| nslookup > /dev/null
done

Re:Good for BIND

[Insurgent2]

Gee, so the basis for the charges against the man in the article were just made up?
Read this amendment to H.R. 1104 [gop.gov]:

Rep. Pence offered an amendment on Thursday, March 27, 2003; it was agreed to by voice vote. The amendment makes it a criminal act to knowingly use a misleading domain name with the intent to deceive a person into viewing obscenity on the Internet. Also makes it a criminal act to knowingly use a misleading domain name with the intent to deceive a minor into viewing material on the Internet that is harmful to minors. A domain name that includes a word or words to indicate the sexual content of the site is not considered misleading.

Re:Good for BIND

[np-complete]

Yes, but BIND already lets you mark nameservers as bogus. If that happens, it's just a simple matter of editing and reloading configuration files.
--

Petition Verisign to change

[digitalgimpus]

http://www.petitiononline.com/verisign/

Re:For Windows Users

[Dr.Zong]

Yeah, how exactly IS this going to help??? Who modded this person informative?

It will only work if you manually try and goto sitefinder.verigisn.com (www, ping, trace, whatever).

Do you really understand how DNS works? If I make a query to iudsbfkjdf.com, verisign redirects me to their IP using the wildcard 'A' record, in which the webpage at that IP CLAIMS to be www.iudsbfkjdf.com.

Adding that to hosts will only redirect you to (in your stated case - google) if you attempt to connect to sitefinder.verisign.com.

Re:Lot of fuss about nothing

[sfriedrich]

No kidding! Now if you ping fartsnuggle.com it just sits and waits for the timeout, but if you ping fartsnuggle.org you get an immediate proper response of "ping: unknown host fartsnuggle.org"

I called their number and got this...

[mdamaged]

I got a rep on the line and he seems oblivious of what was going on, after a bit I got a superviser and she gave me this email telling me that this is where the complaints are going to:

[e-mail]

Re:Good for BIND

[Anonymous Coward]

they did. Just patch and add the following to named.conf:

zone "cc" { type delegation-only; };

The fix provided by isc even allows for denying wildcard records for subdomains only. This has been thought out.

Re:Good for BIND

[ananiasanom]

And in fact it was named after the British decency campaigner Mary Whitehouse [pastornet.net.au], not in any way relevant to the US Govt.

And since Whitehouse is a company, and the White House isn't (although there has been some discussion of that recently), whitehouse.com is much better pointing to the magazine

Re:Yeah, only SPAM, sure.

[LordWoody]

Actually there are plenty of legitimate uses of the wildcard feature. One you might use everyday:

*.sourceforge.com

How do you think they keep on top of that many DNS entries that constantly come and go? You see it at ISPs that do third level (and higher) DNS virtual hosting and and group systems where the URL might be in the form of username.domain.com instead of domain.com/~username/

DNS supports it because it is a legitimate
feature. And less you think removing wildcard support would fix the issue, as it has already been mentioned in this discussion, all Verisign has to do is modify their DNS server to supply responses that appear to make the domain legitimate. They already use non-standard DNS software, why not make a few more changes to enhance their bottom line?

Even after the ISC makes the patch to disable wildcards at the TLD level, Verisign can as mentioned above work around it if they really want to by modifying how their servers respond.

Re:Good for BIND

[leviramsey]

Let's see...

gamefaq.com leads to a page for gamefaqs.com... no pr0n there.

whitehouse.com is the site for a pr0n magazine which predated the internet. The act wouldn't cover that case.

As for resonatorsoft.com, it's not pr0n either.

So you're 0-3 thus far...

Re:It bears repeating

[DavidTC]

Posting with a +1 bonus to attempt to get people to see this.

It's amazing how many super cool random people are running around suggesting using OpenNIC, which, of course, won't do a DAMN FUCKING THING. Anyone who suggests an alternate root has demonstrated they have no knowledge of how DNS works at the topmost level.

Please, someone go around and find all the posts that mention this and moderate them up! I've posted at least three posts pointing this out, and other people have also.

I'm starting to think everyone should have a few emergency -1: Wrong mod points to get rid of information that is just flatout incorrect.

Re:use their T&C against them...

[Anonymous Coward]

See http://www.verisign.com/corporate/about/contact/in dex.html [verisign.com]

for plenty of toll-free (in US) contact numbers.

Re:Bug your ISP

[Neon Spiral Injector]

The bruteforce method:

include "named.delegation-only [clubneon.com]";

Re:Yeah, only SPAM, sure.

[ncc74656]

everybody, click after me

Do not attempt to own us [donotattemptoownus.com]

Doesn't work for me...then again, I've already fixed djbdns [cr.yp.to] here to return NXDOMAIN when a lookup resolves to Verisign's squatter page. (A copy of the patch is here [alfter.us] (the patch isn't mine, but the only place I've seen it is buried in bugs.gentoo.org) and an ebuild for your local Portage tree is here [alfter.us]. To use the ebuild, you'll also need to copy Manifest and files/1.05-errno.patch from /usr/portage/net-dns/djbdns.)

Re:Yeah, only SPAM, sure.

[devilspgd]

Naa, it's dumber then that, it doesn't even look at RCPT or commands at all...

220 snubby2-wceast Snubby Mail Rejector Daemon v1.3 ready
I am
250 OK
Evil
250 OK
Homer
550 User domain does not exist.
da da dada
250 OK
DA!
221 snubby2-wceast Snubby Mail Rejector Daemon v1.3 closing transmission channel

Connection to host lost.

It doesn't care WHAT you type, you get the same garbage no matter what.

Better petition

[kiddailey]

Here is a much better petition [petitiononline.com] entitled: "Stop Verisign DNS Abuse"

offtopic? i think not.

[joe_bruin]

i didn't write this the post above, but it is definitely not offtopic. here's a brief rundown of what it does:

generates a random string of characters.
performs a "wget" to look up that string as a domain name, and fetch the url returned and dump contents to /dev/null. obviously, this string (with appended .com) resolves to verisign's search page.

this accomplishes two things. first, or course, is wasting verisign bandwidth. more interestingly, however, it causes dns servers upstream from you to cache the address of all these garbage domains. when their dns cache fills up, they start discarding older entries they have had in there. basically, this is forcing dns servers to constantly flush their caches of any useful data. this, in turn, makes every valid dns query have to cascade all the way down to the root servers. that is, "slashdot.org" is no longer cached in your isp's dns cache, so every user on you isp trying to get to slashdot is contributing to a DDOS of verisign's root servers.

well done.

Re:One more dnsmasq patch

[hummassa]

replace

while( bogus_addrs[i].addr.addr4.s_addr != (in_addr_t)-1 )

with

while( bogus_addrs[n].addr.addr4.s_addr != (in_addr_t)-1 )

or you'll be sorry.

Re:Who should I write?

[soccerisgod]

I think the chain of command is that

VeriSign ICANN DoC (Department of Commerce)

Patched BIND is an elegant solution

[ayafm]

I just installed the patched BIND 9.2.x for NodeWorks [nodeworks.com] so it could keep finding dead links for customer sites. Without this kind of technical solution, I would have had to check for redirects to the sitefinder site, and added specific logic to mark the response as invalid since it would otherwise return a valid 200 HTTP response code.

The new feature just needed this bit added to named.conf to get it working:

zone "com" {
type delegation-only;
};
zone "net" {
type delegation-only;
};

When its running, it will put message like this to /var/log/messages so you can see it working!

Sep 17 12:58:15 proxy named[1130]: enforced delegation-only for 'com' (www.asdfsdafs.com)

Its really amazing that the open source community can turn around a patch like this within hours of the initial problem being reported! Not only that, but the implementation is clean and technically elegant.