Slashdot Mirror
How VeriSign Could Stop Drive-By Downloads
emcron writes "Ben Edelman has been doing great forensic work looking at spyware, adware, and malware. His latest piece, How VeriSign Could Stop Drive-By Downloads, turns the harsh light of public scrutiny on VeriSign's grubby practices in issuing digital certificates to vendors who try to install spyware by tricking users into clicking 'yes' with low-down dirty lying dialog boxes. Now, Ben wants VeriSign to clean up its act: it should refuse to issue certificates to companies that use obviously fake names (such as "CLICK YES TO CONTINUE") or that use those certificates to deceive consumers."
The beauty of certificates is, you decide who you trust. If you object to VeriSign's practice of issuing certificates to spyware/adware makers, simply don't choose to trust VeriSign's root certificate. This is only a temporary measure, I guess.
Right, and why does it matter when 85% of guys in front of a computer are going to say yes to a company called MAKE YOUR PENIS BIGGER Ltd?
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
Do you just have to click the link, or what??
Don't you mean.. BIZZARO!
Heck, what if they start using a thesarus to pick complicated sound names that sound cool?
And since the purpose of opportunistic companies like Verisign, who's keys are no better than anyone else's, is to make as much doe ray me as fast as possible, why are they going to do this?
Mumia Abu-Jamal is *laughably guilty*. Check the evidence.
I can't deny that VeriSign should be doing a better job with stuff like this, but I certainly don't believe in the claim that by taking their certs away that drive-by downloads will cuddenly stop.
The real problem is the fact that nobody bothers to read the window that has just popped up in front of them. I'm guilty of this myself, there have been times I've not even recognized a problem with certs on my own servers the first few times clicking through.
My saving grace is that I never ever click an OK or YES button unless I'm expecting one. That simple rule has kept me from ever having anything installed using this method. The problem is that not everyone understands that they should not agree to every popup window they see. It's not going to matter if it claims to be authorized by God himself; if it has a YES/NO/CANCEL option and the user is not security-aware the person will probably say yes. I think educating people would be more effetive than trying to get the CAs to revoke the certificates.
I'm sure there will be plenty of the "Use FireFox, Problem Solved!" comments as well. I have experienced, rarely, where a drive-by site is impossible to say "no" to when under Firefox and eventually crashed the browser but IE under SP2 handled itself very well on the same page.
After the whole debacle with the DNS somehow i don't see Verisign prioritize ethics over profit any time soon
If an experiment works, something has gone wrong.
Help us for "free"?
Remember the DNS hijack? They wouldn't back down untill they were sued and threatned repeatedly.
Perhaps, one day after Drive-By Downloads are stopped, a new era could emerge...
A time in which east-side nerds could live side by side with west-side nerds.
I have a dream...
Sigs are for the weak.
Do You Want To Trust The Certificate For Make Your Penis Smaller?
How is Verisign responsible for stupid users? I don't understand why they should deny themselves business by blocking companies called "CLICK YES TO CONTINUE" or whatever the fuck they want.
At the end of the day, it's the end user that agrees to the cert. Stupid is as stupid does. Just let Darwin sort it out.
That is all.
How come they only just now start to question companies with names such as "CLICK YES TO CONTINUE"?
It's so basic that it's sad that they now issue this press release trying to make them look like good guys, even though it's so obvious and should have been looked into much earlier.
That requires VeriSign to actually do something and cuts into their profits.
Look at the mess known as the domain registry and how much junk information is found in there. I'm sure the license for the SSL has the same requirements (and no teeth) just like the DNS registry does.
That doesn't mitigate Verisign awarding certificates from bogus companies.
Its possible to have your Internet Explorer set to accept properly certified code, so in some cases the user doesn't even look.
I DARE YOU TO CLICK YES
we were also considering
CLICK YES YOU MORON
OMG, WERE YOU SERIOUSLY GOING TO CLICK NO
and
THIS IS SO COOL, YOU GOTTA SEE WHAT HAPPENS WHEN YOU CLICK YES
Either that or they face the "threat" that more and more people switch over to Firefox which doesn't use ActiveX at all which in turn means less activex certification profits?
is to design a mechanism for stabbing people in the face over the internet.
Wanna get rid of spyware, adware and malware?
CLICK YES TO CONTINUE
Too often do I trust the wrong sites, with owneres that I personally know myself, to then be bogged down with spyware alerts on my computer. I'm amazed at what Verisign has done in the first place, it makes them seem more concerned about earning money than security over malicious applications and code.
The very cheek of it all, is that the main marketing technique on their website is to talk about security. I think if they were going to clean up their act, they would have done it a long time ago. No hope for some people.
Girls stop drive-by downloads for guys!
And in Korea, they're only for old people anyway.
Reminds me of a comment on politics which also appeared on /. some time ago.
It was proposed to change one's name to None Of The Above and run for presidency.
Seriously. It blows my mind that I can create a site that can make a dialogue box pop up that when the user clicks "yes" can install software. Verisign can't be blamed for that mess. ActiveX, on the other hand, can. Here's how MY browser works: It displays webpages. If I want software, I download it to my desktop. I then choose to open it or delete it. No ActiveX, no auto-launcing/auto-installing/etc bs. What's so hard about that?
Quid festinatio swallonis est aetherfuga inonusti?
Africus aut Europaeus?
"Now, Ben wants VeriSign to clean up its act"
And of course VeriSign will immediately go "Sir, yes Sir, we will Sir! We've already started bending over backwards, Sir !"
This is the point - this means that if, just by accident, it turns out that the given software performs illegal actions, uses your computer to store kiddie porn or starts to send spam to .gov or .mil adresses, verisign can track the body it issued sertificate to and hold it accountable.
And it has nothing to do with actual quality of software it has signed.
Hell yea!
Be better if it was just painful/irritating instead of serious injury/fatality prone...
That way you could do it repeatedly.
The NEW spam!
Come on! Verisign's whole business model is to sell as many certificates as it can - it's simply not in their interests to show scruples like that. Verisign have the MicroSoft seal of approval, so for the average desktop user that makes their reputation beyond suspicion, so they have nothing to lose.
From what I have seen, I believe that the employees at Verisign are "Clicking yes to continue" when approving certificate requests. Or someone mistakenly clicked the "Yes to All" button.
Indeed.
Basically a certificate signed by Verisign is just that and only that. It's a certificate signed by Verisign. It doesn't say anything about the person or company presenting the certificate, their partners, business practices, history, ethics or ANYTHING ELSE. The only thing it's safe to assume is that someone fed Verisign a (probably valid) credit card number and they received a signed certificate (which you're looking at). That's it. End of story.
For some reason people see the words 'signed' and 'certificate' and assume there's some automagic security haze covering everthing and they get really upset when this turns out not to be the case.
When people start blathering 'Oh, but I just assumed...' remind them that assumption is the mother of all fsckups and they really should have learned that lesson by now.
Jesus 2.0 is vaporware. All that anyone knows about it is that it is "coming soon"
...is to trust everyone.
They have to.
Every site that they visit will have embedded Flash, embedded Java, embedded QuickTime, embedded Real, embedded midi (FFS!).
They are taught on their first few days to trust everyone, and that nothing that they want to achieve can be done without trusting that the site is legit in asking you to download and install stuff.
And when they speak to their geek friends (or friends of their kids), they get told dismissively and condescendingly that YES, they must install to see the site properly, to do what they want. You can bet that they won't ask a second time!
Is it really a surprise then, that we have a problem later with dumb users downloading spyware, adware, and malware in general?
The problem could be much alleviated by simply pre-installing all of the key technologies in advance.
Some Linux distros do this... my mother knew from the first moment she used Simply Mepis that she didn't need to download anything else... I told her this, and because nearly all of her sites worked (just not pogo.com) she hasn't downloaded anything else.
But you can't do this with Windows... because Windows gives you nothing, and certainly nothing from Apple, Real, Macromedia, Sun, etc... and then to compound it, Windows is an open playground for malware once downloaded.
If Windows RME were permitted to be shipped with not just alternatives and pre-configured competitor offerings for media, but also with common plugins for the web... and... maybe even Firefox to give choice... then this would do more to prevent malware spreading than Verisign being forced to change their practices.
Of course... hell would freeze over, pigs would fly, and the Bush would have an epiphany on social welfare before all of the above happened.
only refers to trojan and virus, it doesn't care about hijacker, spywares, adware etc.
In this certificate thing, is it verisign that doesn't care about user's "safety" on the net or is it microsoft that don't bother what verisign does since this is just something to promote that windows are safe?
I would trust program that aren't signed more than signed ones
I am harvesting funny/good quotes. Please help by putting them in your sigs
In no way to I want VeriSign or any other certificate authority to decide who does or does not qualify for a certificate outside of the flat fee. I do not want a corporate entity making suposedly moral judgments on what I do or do not do with my certificate. That opens a whole world of abuse probability, why not just label dissenting t-shirt or sticker sites as anti-american and not issue to them? There is a whole bag of questionable motives when you start playing elitist. I question anyone who says "let's lock out this group of people with a blanket policy". If you want to stop people from trying to trick you, or swindle you, then learn to be smarter about what you are doing. Individuals have a responsibility for their own actions. These swindlers run the risk of getting caught in an illegal act and going to prison, and you run the risk of getting played if you don't pay attention. It has been said a number of times that the web is a lot like the old west in the US, you have to watch where you step. Play with sites you know to be safe, and pay attention. That's all there really is to staying away from adware and spyware and malware and, and, and. So again, no, I do not want a company telling me "no, _you_ are not allowed to buy a certificate because we think you might be naughty with it"
You haven't seen goatse yet have you?
Obviously, nothing happened afterwards.
The only real valid application of certificates seems to be that X program really is from Y company...
As to whether or not Y company is trust-worthy is still up for debate.
MadCow.
Obviosly 90% of the people posting in this discussion have no practical experience with this subject. The certificate in question is a code-signing certificate. Have you ever bought (or tried to buy) one of those from Verisign? I have and let me tell you--it is a royal pain in the ass. I can say with almost certainty that those certificates that are from a company called "CLICK YES TO CONTINUE" did not come from Verisign.
/. ignorance.
It took me nearly two weeks to track down all the paperwork to get my code signing certificate (authenticode). The process includes designating two contacts, faxing over several forms (including a valid county business license for the company name on the application) and a notorized agreement of indemification because they weren't able to do 3rd party identity validation on my company (they look your company name up in the white pages and call the number to make sure it exists and that you do indeed work there. My company wasn't in the phone book.) They also try to look you up in D&B. This all came after giving them the $500 for the certificate.
That being said, I don't see how anyone could get away with purchasing a certificate such as described in the article from Verisign--maybe Thawte or another. IMO Verisign is taking some flak here due to
Teaching individual users to be more informed and responsible about whom they trust may be difficult, but it's better than entrusting a private, unaccountable, quasi-monopoly (let alone one with a history of un-trust-worthy behaviour) with that decision.
http://alternatives.rzero.com/
Why hasn't this company been banned from having anything to do with the Internet?
Time and time again it gets busted doing crap like the SiteFinder fiasco and still they get away with it.
Software should NEVER be allowed to install itself! I'm sure some genius at MS thought it would be a great way to lure developers into using ActiveX instead of Java.
The proper behavior would be to have a user find a download, click the download to put it somewhere on the hard drive, then have the user "double-click" the file to install the software. This would totally prevent drive-by downloads.
-ted
Firefox should have a mechanism to assign different levels of trust to CAs - http://www.openca.org/openca/ would have a higher level and VeriSign a lower level.
This could be changed by the end user, though.
When the user gets presented with a dialog box, Firefox would suggest the user to not trust VeriSign-signed sites.
The "VeriSign penalty" could be adjusted in each new release based on their willingness to ge their shit together. Fuckos.
All my Silicon niggas, uhh,
All my MIT bitches, uhh...
(repeat and then freestyle about hacker lifestyle and experiences with spyware in the ghetto, with repeating drum beat in background)
You can hold down the "B" button for continuous firing.
"He who would learn astronomy, and other recondite arts, let him go elsewhere. " -- John Calvin, commenting on Genesis 1
> And when they speak to their geek friends (or
> friends of their kids), they get told dismissively
> and condescendingly that YES, they must install to > see the site properly, to do what they want. You
> can bet that they won't ask a second time!
Not this geek friend. I tell people not to trust anyone on the internet and to never download any crappy plugins as 90% of them will simply be used for serving up intrusive advertising. And if the site doesn't work without their plugins them go elsewhere.
After I've removed the first load of spyware and repeated the advice they usually listen. If not they don't get a second visit from me. I just point them to the internet and say "You're not interested in my advice so you can fix things yourself".
Sorry I've gone half tilt Amish on the idiots of the internet. If you can't get your message over to me using plain old HTML and static images you can stick your message up your arse.
The internet is not digital TV.
Personally I can't wait 'til someone invents some sort of uber bandwidth media-tastic bright & shiny "Hyper Net" (now with unbrakabul DRM (tm)). Then all the drongos can go and happily consume on it whilst leaving the rest of us with our "good old" internet.
Plugins ? I spit on you all.
Sky subscribers are morons. They pay to be advertised at !
This program has been quite helpful on an enterprise deployment to prevent the "download this?" type boxes that pop-up and install 99% of most adware. It's free, and only changes configurations and you're done with it at that point, so I'm happy to suggest it.
m l
http://www.javacoolsoftware.com/spywareblaster.ht
The other solution is to quit treating digital certificates as something to do with trust (the authorization-vs-authentication fallacy). Microsoft's stupid "security zones" model takes this blatant idiocy further than anyone, but all browsers have adopted some similar conceptual structure.
A certificate doesn't tell you anything about whether a web site is secure, trustable, or anything else. It simply provides a slightly better verification of identity.
will get you a SUSE-Linux-for-Windows ISO.
Not quite drive-by, becuase you'll have to register (free and anonymous), but not such a bad idea.
Does this http://home.btconnect.com/chrisandcarolyn/suse-for -windows.png . Trust me.
Which should tell us there's a bigger problem here than whether Verisign is, in the fashion of the AKC, turning a blind eye to puppymillers who'll pay for registration papers.
If users have been conditioned to routinely say "yes" or "OK" to anything they see, it's partly because the APIs they deal with all day long encourage the writing of bad, unintelligible dialogs. Anyone who's ever waded through the "Yes No Help" dialog box when saving to a .csv file from Excel knows this problem. That one's unreal: they give us a bulleted list in the dialog that basically translates the buttons.
It's no accident that tons of the spyware pop-ups out there look like Windows dialog boxes. People are so used to clicking through horribly-written dialogs that they don't pay any attention. A better set of API default dialog types would nudge everyone, programmers and users, in the direction of actually readable dialogs that mean something.
"Fundamentalism" isn't about divine morality. It's about human authority.
Am I the only one who first thought that this had something to do with wardriving?
The only real use of a certificate is to show that the software you download is actually from the company that it's claiming to be from.
The trust-worthiness of that company is still in debate... you just now know who it is you're dealing with.
MadCow.
I used to have a sig, but I set it free and it never came back.
For the love of everything sacred... stop prefixing every IT activity with the term "forensics". There is nothing this guy has done that would remotely qualify as forensic work.
Seriously, anyone who clicks on crap like that deserves to get screwed! My father-in-law is one of those types. It's a compulsion. He clicks on any spam, pop-up, or banner ad no matter how many times I've told him to stop. I had to set up a very restricted user account on his computer. Essentially he's unable to download or install anything. But he's been spyware free for over a year now.
If someone says he and his monkey have nothing to hide, they almost certainly do.
I can understand why ActiveX sites wouldn't work - but not Java!
the The Drive-By Truckers?
Read my Technocrat article for more info and I also submitted to Slashdot, but it got rejected - oh well.
Hulk SMASH Celiac Disease
How's about you stick to Gopher if you don't want anything else out of the internet? Then you could let all us 'drongos' happily consume on the "Hyper Net" tx.
There are other ways to help people.
No Comment.
Most of the time they don't work either because they need java or activex, or because they are just broken.
Both ActiveX and Shockwave won't run, short of running WINE, but Java? All you have to do is download the RPMs from here.
You'd be surprised. Our company bought a product from UPS logistics that uses the Sun Java runtime but doesn't work in Firefox. (yes I'm serious). Turns out they have a bunch of IE only javascript that sends parameters to the applet, whithout the parameters it doesn't initalize. I dug around the system for like an hour trying to figure out what it was doing, but in the end just gave up. Lazy programmers will always bone you, no matter how portible something is supposed to be.
Do you want to install and run "ULTRA-FAST P3N!$ ENHANCER 4.3" signed on 3/27/2003 10:54 AM and distributed by:
CLICK YES TO CONTINUE
Publisher authenticity verified by VeriSign Class 3 Code Signing 2001 CA Caution: CLICK YES TO CONTINUE asserts that this content is safe. You should only install/view this content if you trust CLICK YES TO CONTINUE to make that assertion.
[] Always trust content from CLICK YES TO CONTINUE.
my analogy would be the issuance of a driver's license. a check will be done to authenticate a person and imprint the details in the id card. now, the dmv or whatever department does not check for a person (or maybe in a limited basis - since i don't live in the usa) if they have a tainted image as long as probably they don't have any police records (not sure about this.) they won't be asking your peers if you are a good and worthy person.
now what i think should be done is to create something that will validate companies based on their behavior, track record, customer service and satisfaction, etc.
Live your life each day as if it was your last.
Great. I really want Verisign deciding what is and is not an "obviously fake name". Aren't there already too many chokepoints under their control?
Free speech is free speech, even when jerks use it.
you were just reading bash.org weren't you?
What you're saying is that we should use VeriSign to certify that we are getting the correct spyware?
I think the problem is that VeriSign certificates don't do much to begin with. Let's say I get a piece of software from UltraSoft Inc. Is it spyware or not? All the certificate tells me is that it's happening.
Which is something. But certificates look official and fool newbie users into the idea that they can now make an intelligent decision. If anything, at least the fake ones make it obvious!
What is this "goatse" of which you speak? I am just a poor goatherder, and I would be very grateful for any information that would help me take better care of my charges. Thank you.
OEMs often do this. Any computer I've purchased in the past few years has come with Shockwave and Sun Java preinstalled, and much to my chagrin, often RealPlayer as well. OEMs can't just download, install and configure, however. They need the appropriate support structure internally to handle the third-party software. They also often need agreements with the producers of the software in order to redistribute it in a commercial context.
I know you're trying to pin blame for this onto Microsoft, but Microsoft really doesn't have any say in what the OEMs do anymore.
..is a "Verified by Slashdot" certificate.
I'm not a user so i guess i can link to them all i want.
West Siiiiiiiiiiii-eeeeed!!
Read Heinlein's 1953 Revolt in 2100, now more than ever.
The point of certificates is to prevent impersonation of trusted sources by untrusted sources. Anyone can register a valid company name. Verisign considers proof of name a printed phone listing (they call you back at the published number) or a notarized copy of a business license.
So somebody seems to have registered a company name "Click YES to continue" in some state. It's probably a legal company name. I agree with the author that this is obviously deceptive practice, and Verisign should revoke the certificate revoked. In addition, we should be able to complain to Verisign about other companies violating the Verisign agreement.
I don't know what they do if the company name is a duplicate of another previously registered name.
Here's the original: "i'm going to become rich and famous after i invent a device that allows you to stab people in the face over the internet" Not sure who said it though...
Because in the quarter-second they actually have the diaog box up, they see : blahblah CLICK YES TO CONTINUE Publisher blah blah
Our DARE officer from back in elementary school said it best: Just Say No.
If in doubt, go to the source
Verisign's main corporate asset is trust, the entire certificate business is centered arround that trust. What we have to trust is that Verisign has in place an effective mechanism to insure that entities are in fact who they say they are and is applying that mechanism effectivly. It appears that Verisign is not effectivley applying that mechanism, and are wasting their most important asset. For quite a while I've suspected that a Verisign cert only meant that some paperwork was filled out and a check cashed.
Personaly I don't care if Tony Suprano is doing it as long as he insures the entities are who they say they are and is actually enforcing the contract.Tony might be better, the dirtbags are less likely to jerk him arround.
Apocalypse Cancelled, Sorry, No Ticket Refunds
I suppose it would be a pain to fairly and legally distinguish between a drive by downloader and, say, Macromedia. Especially such that companies in the grey area (weatherbug, yeah, I hate them too, but they seem more or less legit these days). What do you do when the company 'CLICK YES TO CONTINUE' sues you. Silly, I know, but what if you're company's called 'My IE enhancements'. I say that's a drive-by, it's it's legit sounding enough for a real company to maybe be behind it.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Maybe we should make the FireFox browser invert the question and say "Are you sure you do not want to run this signed application?"
That way, when users instinctively just press "Yes" it will just go away and not install.
Surely you jest. They're still trying to hijack DNS, using the NetSol domain lookup page a couple of years ago meant the name got hijacked within 48 hours, and AFAIK NetSol is still screwing people on domain transfers to other registrars.
The above weren't isolated instances, but happened often enough to show that's the way NetSol, and by extension VeriSign, do business.
I agree with this mentality. While I haven't killed flash for my browsing experience, I can't stand the sites that use MonsterTemplate.com or something like them with their repeating flash toppers that are just like the html blink tag. If I'm reading a page, the last thing I want to catch my attention is the topper that is just whisps our blinking blocks.
On a very rare occasion, I may design something in Flash, but I ALWAYS export it as a GIF movie and never let it repeat. While flashy (no pun intended) are neat, they are not always needed.
Personally I can't wait 'til someone invents some sort of uber bandwidth media-tastic bright & shiny "Hyper Net" (now with unbrakabul DRM (tm)). Then all the drongos can go and happily consume on it whilst leaving the rest of us with our "good old" internet.
We call it Usenet. We're glad the drongos have moved on to places like Slashdot.
paintball
the problem is literacy and common sense, something that many people seem to lose the minute they touch a computer.
They never had it in the first place. It's just more noticable when you let them touch a computer instead of, say, just allowing them to watch TV.
paintball
http://shit.slashdot.org/article.pl?sid=05/02/14/0 149211
Do you understand what a certificate does?
It's one person (verisign) vouching for the other person (purchaser of the cert).
If you don't trust the both the good will and competence of the one person, then what they have to say about the other person's is meaningless.
I'm hoping verisign will screw this up so royally that people begin to understand that they can get *exactly* the same security by either:
A. Ignonring certificates altogether.
B. Using other tools to build a web of trust within your working group.
"Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick
If all it can do is provide a reasonable guarantee that a particular piece of software comes from a given company, what's the point??? I want a reliable guarantee that the software contains no malicious code or adware -- until VeriSign can do that, all they're providing is a false sense of security.
"bonzer's not my buddy"
its bonzi buddy stupid
Bypass Compulsory Web Registration -- http://bugmenot.com/
Let's see:
VeriSign has made every effort to develop a reputation worthy of trust. VeriSign's client agreement says that the clients should not be perpetrating such deceptions. It should be obvious[*] to VeriSign that some of these product names are blatant attempts at deception.
Sounds to me like VeriSign is ripe for a class action lawsuit, filed on behalf of everyone who has ever been victimized by one of these deceptions.
You know, I used to be wholly of the opinion that there is too much litigaion, too many class action lawsuits. And I think there probably are. But this is an example of why I think tort reform must be handled carefully: VeriSign is clearly being negligent in not performing a basic level of vetting ad validation, a level that is far below what it seeks to establish as the level of trust by which it is worthy.
If I am selling apples, I am responsible for ensuring that there are not too many rotten apples in what I sell.
If you seek to sell trust, you must be willing to defend your own trustworthiness.
([*]Even if the release of new signatures is fully automated, thhis does not release VeriSign from the obligation to perform some minimal level of checking. E.g. I think that they would be obligated to have a list of words or phrases not allowed in the company or product name, and a mechanism for updating such a list when a new deception is uncovered.)
For the folks who say that they are tired of protecting stupid people: Caveat Emptor went out with the Romans. English Law, the law that the US and similar countries lives by, assumes and requires basic standards of behavior.
After reading the article I was reminded of the common practice in the late 1980s and early 1990s, before cell phones were nearly as common as they are now, of people registering long distance phone companies with names like "it doesn't matter" and "makes no difference" so that when an unsuspecting pay phone user, at an airport say after a long flight, was asked which long distance company's services they wanted they would get stuck with one of these unscrupulous operators who would then proceed to charge them out the nose, ~$5.00+ per minute, for the call (especially on those card phones which took credit).
VeriSign's main corporate assets are having their roots hardcoded into browsers and owning the .com registry. I've applied for more than one VeriSign Class 3 certificate, I know people who work there, and I know what kind of Charlie Foxtrot their operation is. In fact, a while back they even got hoodwinked into issuing certificates in Microsoft's name to someone else entirely, which led to a rather embarrassed addition to the CRL a couple of weeks later.
Unfortunately, at VeriSign, The Value of Trust(tm) is whatever you're willing to pay.