Blocking SiteFinder Service

apankrat writes "Given VeriSign's position on wildcard redirection service, it looks like it's time for a simplier and more efficient ways of bringing things back to where they were. For those running BIND there is a patch; for those on the client side - there is a dnsfix for Windows and the usual iptables hackery under Linux. Aware of any other clean and easy ways to block wildcarding ? Post below."

Comments

dnsmasq has a fix

[hummassa]

here.
version 1.16 is ok.
others have fixes, too, you can find them in this place.

hope I have helped,

This is working for me in my Firewall

[southern]

I added this to my FORWARD rule on the Firewall:

iptables -A blocked_sites -p TCP -d 64.94.110.11 -j REJECT --reject-with icmp-host-unreachable

Will be doing the DNS patch soon. But this works for now.

or just add a line to etc hosts

[coyote4til7]

The way I've dealt with it under both XP & OS X is to modify etc/hosts.

Under OS X, Solaris, Linux, etc., it's "/etc/hosts". Under Windows XP, it's "C:\Windows\system32\drivers\etc\hosts"

In either case, add this to the end of the file:
0.0.0.0 sitefinder.verisign.com

Wah-lah!

do NOT blackhole/block 64.94.110.11!

[graf0z]

... because then mails to mistyped domains will end up waiting in MTA-queues instead of being bounced immediately (some other protocols may have weird behaviour, too). Instead:

• Read this and this before you panic
• ask your ISP for patching bind (or whatever ns-software they use)
• install a patched bind (djbdns, ...) locally as a caching dns
• if you have no chance of using a patched nameserver (why that?), you may reject (not: drop) 64.94.110.11:80/tcp only and install one of those patches to your MTA (postfix, sendmail, ...)
• if you are customer of verisign, ask them for suspending their new "service"

/graf0z.

djbdns (dnscache) patch

[asackett]

Here is a site linking to a patch for dnscache users. I'd prefer a hack along the lines of what [groan] ISC has implemented, but if verislime were to delegate and then spoof, ISC's hack would stop working, while the dnscache patch would simply require a bit of administwiddling and then keep right on working.

Patch 'em up and move 'em out...