Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
The Internet Your Rights Online

Study Reveals How ISPs Responded to SiteFinder 172

penciling_in writes "During the 2+ weeks for which Site Finder was operational, a number of ISPs took steps to disable the service. A study just released reveals the details and analysis, including specific networks disabling Site Finder during its operational period. For example, the study reports China blocked the traffic at its backbone, and Taiwan's Chunghwa Telecom and Korea's DACOM also disabled the service. US ISPs have been slower to act, but US ISP Adelphia disabled the service September 20-22 before re-enabling it on September 23." That link is a summary; or cut straight to the study itself.
This discussion has been archived. No new comments can be posted.

Study Reveals How ISPs Responded to SiteFinder

Comments Filter:
  • by Anonymous Coward on Tuesday October 07, 2003 @12:50PM (#7154230)
    I wonder how many other small-network admins did... I guess they're harder to sample though.
  • by The One KEA ( 707661 ) on Tuesday October 07, 2003 @12:53PM (#7154263) Journal
    Most major ISPs and institutions successfully blocked a "service" which only resulted in widespread disruption in the way the Internet works. It didn't necessarily stay blocked, as in the case of Adelphia, but it was blocked rather quickly. I like the graphs showing SiteFinder traffic; they're very easy to read and they show the drops quite clearly.

    Looking through the study, I found something interesting: most of the blockages of SiteFinder were outside the U.S. Interesting.....
  • Denmark (Score:5, Interesting)

    by pointwood ( 14018 ) <`jramskov' `at' `gmail.com'> on Tuesday October 07, 2003 @12:54PM (#7154285) Homepage
    I know the biggest Danish ISP (TDC) blocked it pretty quickly. TDC have >80% of all DSL connections in DK.
  • Re:Disturbing (Score:2, Interesting)

    by wankledot ( 712148 ) on Tuesday October 07, 2003 @12:59PM (#7154353)
    Why can't you believe that? Verisign is not a NPO, they're a company that exists to make money. Seems pretty straightforward to me.
  • by Anonymous Coward on Tuesday October 07, 2003 @01:02PM (#7154391)
    Sitefinder did not seem to redirect images. I was trying to debug an image server I set up and keep getting a 404 when trying to load a test image. After spending about an hour looking at httpd.conf, I realized that I had mistyped the url. The 404s were coming from sitefinder. My server was set up correctly from the very start.
  • Telenor (Score:3, Interesting)

    by Anonymous Coward on Tuesday October 07, 2003 @01:17PM (#7154545)
    I left a note for Norway's biggest ISP and phone company, Telenor [telenor.net], with details of what had happened and a polite request that they undo it at their name servers. I was very pleased to see an email come in from the hostmaster himself, saying they were aware of the problem and that he would get back to me on it. A few days later (actually, this was after VeriSign had agreed to succumb to ICANN's demand) I got a new mail from him again, saying he had given the notice for the patches to be applied.

    This is a company that isn't exactly the most liked in Norway, but I was very pleased with their handling of the problem and the responses.

    And it shows that most admins are not willing to tolerate absurd changes like this.

  • Re:AAARRRGGG!!! (Score:5, Interesting)

    by dissy ( 172727 ) on Tuesday October 07, 2003 @01:18PM (#7154551)
    > I don't get the big deal with this.

    Well, when people code DNS clients and librarys, they generally do so by following the RFC.

    The RFC states that when a domain does not exist, the name server returns the code NXDOMAIN.

    So, logically, if you get a NXDOMAIN code back, the domain does not exist.
    Verisign changed this RFC defined rule, and every single DNS using application is now broken, as they assume the information in the RFC spec is correct, and it is not so any longer.

    There are many different things that broke because of this, which as an end-user of the internet you probably wont notice much of.
    People that run service on the internet however do need to know how such servers are suppost to act. Verisign changed the rules without so much as telling anyone.

    RFC stands for request for comments. You submit one, and _request comments_
    Only after that phase is the RFC out of draft and so people start concidering to use it. This is how a standard is born via RFC. Verisign did not submit a new RFC requeting a change to the original one.

    It would be like a web server chaning the numerical error codes.
    404 means page not found. 900 is not defined.
    Sending a 900 code when page isnt found would break every existing client.
    This is what verisign did for DNS

  • by Anonymous Coward on Tuesday October 07, 2003 @01:28PM (#7154660)
    I don't work for an ISP but I do have about 1500 staff users, plus another 9-10 thousand K-12 students who use the network too. The day this happened, I added some IP-based blocks to our web proxies to deny all access to sitefinder, then made the deny info throw back something that essentially said "That domain does not exist. Check the spelling and try again". Then I filtered outgoing packets on the mail servers to prevent leakage there.

    When the first BIND patch with delegation-only rolled out, that went on our resolvers and the real problem went away. Now the spammers couldn't make up arbitrary crap in .com and .net, and my old deny page was no longer necessary.

    Anyone in the organization who heard about the fuss and tried to play with sitefinder had a window of about 12 hours before the changes took effect. Since then, it's been walled off.

    Chances are, the bigger the organization is, the slower they move on changes like this. There's just too much bureaucracy to go through before you can do something like replacing your resolvers with new code.
  • Spam Solution (Score:3, Interesting)

    by RuB1X ( 707519 ) on Tuesday October 07, 2003 @01:39PM (#7154789)
    Copied from here [theregister.co.uk]

    But there is(was) a solution, perhaps mail servers should check to see if the sender domain for a particular piece of email resolves to the Ip above.If it does, forward the email toVerisign, any of the email addresses on this page should do :

    http://www.verisign.com/corporate/about/contact/in dex.html?sl=060104

    If the email sender domain resolves to the bogus Verisign wildcard entry, then its only fair that the email gets forwarded back to them, as it?s obviously spam and it resolves to their address.

    Just in case Verisign turns it back on, be ready.
  • Criminal Skills (Score:5, Interesting)

    by g051051 ( 71145 ) on Tuesday October 07, 2003 @01:45PM (#7154836)
    My company uses SmartFilter. One day, it started blocking access to Site Finder. The reason code it returned indicated that sitefinder.verisign.com had been classified as "Criminal Skills". That sure seems appropriate to me.

    My personal solution was to add it to my junkbuster config, so it would never show, and never register as a hit on their web page.
  • Re:Disturbing (Score:2, Interesting)

    by gsparrow ( 696382 ) on Tuesday October 07, 2003 @01:47PM (#7154850) Homepage
    They are a for profit corporation, but they are also responsible for managing the .com and .net domains and if they want to continue doing so they will have to consider all the implications that making decisions like this will have. I don't think that anyone will argue that there was a blatant disregard for the rest of the internet community. Is that who you want managing the root DNS server for the .com and .net domains?
  • by tugrul ( 750 ) on Tuesday October 07, 2003 @01:53PM (#7154892)
    Anyone notice that while the sitefinder service was up, typos were beginning to get into the browser history since they didn't error out? And the next time you wanted to goto the same site, autocomplete would pick up the typo instead.


    I'm just glad that was the worst that happened to me before this "service" got blocked here. I feel for the grandparent.
  • Re:Disturbing (Score:2, Interesting)

    by wankledot ( 712148 ) on Tuesday October 07, 2003 @01:54PM (#7154906)
    I'm not arguing that they were wrong, I think it was an obvious misuse of their power. But I'm also not surprised.

    When you have a company in that position... with the ability to easily use a position for an obvious gain, and with a grey area of what's right and wrong (grey to them, not to us.) I think that it's very likely they will try to get as much out of their investment into the .com and .net domains as possible, and push the envelope at every turn. Thankfully they're being met with some resistance.

    I'm sure trying this was seen as a measured risk for them, and now it's not paying off, much to their displeasure.
  • by steve_l ( 109732 ) on Tuesday October 07, 2003 @02:08PM (#7155057) Homepage
    Instead of an unknown host error, you get a 302 + text/html redirect that leads to a 200 + text/html page.

    This plays havoc with Web Services, that expect 200+text/xml on a successful response. The SOAP Stacks either died on the 302 error code (Apache Axis), or the HTML body (MS .net). Either way, the errors were not at all intuitive.
  • by jroysdon ( 201893 ) on Tuesday October 07, 2003 @03:26PM (#7155779) Homepage
    We bound VeriSign's SiteFinder IP to one of our webservers and added it into our routing table:
    eth0:2 Link encap:Ethernet HWaddr 00:10:4B:21:48:CF
    inet addr: Bcast: Mask:
    Interrupt:11 Base address:0xde00
    Then we served up a wildcard [artoo.net] page for *.com and *.net:
    DocumentRoot /var/www/html/wildcard
    ServerName wildcard.artoo.net
    ServerAlias *.net
    ServerAlias *.com
    CustomLog logs/access_log.wildcard combined
    The page directs users to complain to Congress, ICANN, and the FTC if they don't like the way VeriSign is hijacking the internet.

    Like I said, we're a really small ISP, but it appears we caught 281 typo's (excluding anything that was referred from Slashdot).

    It's pretty amazing to look at the common sites that folks typo.
  • by mabu ( 178417 ) * on Tuesday October 07, 2003 @04:04PM (#7156173)
    There's no indication that ICANN or Verisign will learn anything from these events. These are just the most recent in a long chain of embarassements and slaps in the face to the Internet community.

    NSI/Verisign violated agreements by charging for domains in the first place; NSI/Verisign charged an "illegal tax" on domain registrants and stole millions of dollars; Verisign strong-armed the community by almost-monopolizing the SSL Cert business and charging outrageous prices; ICANN made a total mess out of the new TLD rollouts; ICANN pulled political deals that weren't in the best interest of the Internet community when they continued to allow NSI/Verisign to manage .COM/.NET. Nothing has changed. These companies and organizations do not serve the online community -- they serve only their corporate benefactors.

    The only way to teach these entities a lesson is to take away their power NOW!

Never say you know a man until you have divided an inheritance with him.