VeriSign Sued Over SiteFinder Service

dmehus writes "It was only a matter of time, the pundits said, and they were right. Popular Enterprises, LLC., an Orlando, Florida based cybersquatting so-called 'search services' company, has filed a lawsuit in Orlando federal court against VeriSign, Inc. over VeriSign's controversial SiteFinder 'service.' While PopularEnterprises has had a dodgy history of buying up thousands of expired domain names and redirecting them to its Netster.com commercial "search services" site, the lawsuit is most likely a good thing, as it provides one more avenue to pursue in getting VeriSign to terminate SiteFinder. According to the lawsuit, the company contends alleges antitrust violations, unfair competition and violations of the Deceptive and Unfair Trade Practices Act. It asks the court to order VeriSign to put a halt to the service. VeriSign spokesperson Brian O'Shaughnessy said the company has not yet seen the lawsuit and that it doesn't comment on pending litigation."

Nice tactic.

[NightSpots]

Anti-trust was one of the very few tactics I didn't hear discussed as possible ways to stop Verisign.

Arguing that they get for free what other companies must pay for is probably one of the easier arguments for win, since it proves itself nearly by definition.

I applaud the jackass who pays to abuse typos. At least they've finally proven their worth.

Re:I've never understood

[bersl2]

Because sometimes that "land" has been previously owned, and the rights to it expired (not always intentionally).

There's nothing wrong about cybersquatting, but it's Just Not Right(TM).

Re:I've never understood

[JayBlalock]

Well, the term has gotten expanded to mean pretty much "owning a domain you don't use." But originally it referred to people who would, say, buy the rights to a celebrity's name .com, and then extort them into paying lots of money to get the rights to it. This ended once the first trademark-infringement case went to court. However, the general term stuck around and is now (IMHO) generally way over-used.

Most ISPs have blocked it

[Amsterdam Vallon]

*Confirmed*: Adelphia has blocked VeriSign's new "service."

Please reply to this and list names of fellow anti-VeriSign ISPs if your ISP has blocked this new "feature" as well.

Thanks! I will enjoy analyzing this data.

and the IEFT now has an Internet-Draft

[shostiru]

which I just found, draft-main-typo-wcard-02 [fysh.org]. Worth a look, as is the IETF mailing list archive [ietf.org]. They're definitely aware of the problem. I particularly like following paragraph from the Internet-Draft:

An error response that only works correctly in one situation would be as bad as an SMTP server that ignored its input and always produced a fixed sequence of responses: it would work in the one situation it was designed to expect, but cause chaos whenever presented with any other situation.

sounds like the Snubby Mail Rejector, hmm?

Re:I've never understood

[marphod]

How is it different from the pioneers getting 40 acres and a mule?

First, a history lesson. '40 Acres and a Mule' wasn't a pioneer issue. What it is true that during the western rushes, various federal lands were put up for auction or claim by pioneers. The lands were not, however, specified to be 40 acres, but varied in size based on the territory and the specific land grant. For that matter, according to one of my HS Social Studies teachers (a dozen years ago), there were still federal lands for claim in parts of Alaska. That teacher was known to embellish the truth, so I won't put any varacity statement with that.

'40 acres and a mule' were reparations for slaves in the south. They were instituted by a Northern (Union) general, during the aftermath of the civil war, and were later reveresed by an presidential executive order.

So, in short, your parellel falls a little short. If the ICANN were to pass a ruling granting johnny-come-latelies names from vast corporate pools, that would be comprable.

So, what's wrong with cybersquatting: Well, with the federal land grants, if you occupied and developed the federal lands for a specified period of time, they became yours. You could sell or otherwise use them as you wished. Here, cybersqquatters either are taking a developed item (debatably property) and using its good will and value for an interest contrary to the orginal owners. Which would be a violation of the land grants, so thats one point where your analogy fails.

The other type of cybersquatter (who speculates on names or misspellings) is also abusing the good will of the originator, but may be a valid comparison. It is, however, annoying, to get redirected away from what you wanted because of a typo, and from the other side, a squatter who is taking an otherwise useful resource and making it near-useless is neither providing a valid service or generating good will.

Don't badmouth Netster too bad

[Tyler Eaves]

Yes, it's semi-sleazy, but they don't cybersquat.

Timeline:

1997 or so: I registered tylereaves.com, mainly for use in e-mail

2000: I let the domain lapse, not really using it, and tired of paying $40 a year or so for it (Hey, registering was expensive in '97!)

200?: Netster becomes the owner of tylereaves.com

2003: I nicely ask for it back.
2003: I get my domain back. They didn't even charge me the trasnfer fees.

Technical defense against hijacked domains

[ODBOL]

This is a good time to look at Bob Frankston's dotDNS proposal [circleid.com] for a layer of reliable but meaningless domain names. dotDNS lookups can be made self-verifiable using public-key signatures, but without the costly chain of trust required by DNSSEC methods. The validity of a dotDNS binding can be verified easily by the querier, without relying at all on the server that provided the putative binding.

dotDNS does not solve the whole problem, since any layer that translates from humanly meaningful names to dotDNS names is still vulnerable to hijacking. But the reliable and verifiable name bindings in dotDNS will make it *much* easier to switch name-resolution services when we are dissatisfied with their policies.

dotDNS is a cheap and immediately deployable positive step toward fixing the DNS mess, requiring no approval by any central agency. It's time for a visionary sponsor to step forward and just do it.

Owning a domain you don't use

[Animats]

Owning a domain that wasn't in DNS used to be called a "lame delegation". At one time, about a decade ago, it was considered reasonable to garbage-collect domains that were lame delegations, but that was back before the Internet went commercial. Now you can have all the lame delegations you want.

But why? There's no real market in domain names any more. Verisign tried to make one. GreatDomains used to have thousands of listings, and you'd see things like "Asked: $25,000. Bid: $20." Now Verisign only has "premium domains" on GreatDomains, ones like "record.com". There are only 66 domains for sale, and few sales.

Re:"Unfair advantage"?

[sillypixie]

• So Popular Enterprises' complaint is not that VeriSign is cybersquatting, but that they're doing it more effectively without letting others have a slice of the pie?

No, I think their complaint is that Verisign is in charge of baking the pies in the first place... it's hard to develop market share for your product, if users are diverted upstream.

Re:Most ISPs have blocked it

[shostiru]

We (mid-sized midwestern ISP) had our main nameservers (tinydns and djbdns) patched by 2AM the night this mess started, using the patches we found here. By a few hours later, I'd kludged the BIND source myself on a couple of other machines to return NXDOMAIN for anything in all three of the /24 netblocks in AS30060 (it worked fine, at least until the ISC patch was released). AFAIK our customers never even noticed the wildcarding.

If you work in an ISP or other network infrastructure company, you know first-hand the degree of astonishment and rage that Verisign's move elicited; the fallout (spam filtration, security, network monitoring, etc.) goes far beyond HTTP. I don't think any of us slept much that night ... it only took a few hours to restore normal DNS behaviour, the remaining ten or so I spent in shock with my jaw scraping the floor.

I've dealt with Verisign before (try getting decent documentation on the cybercash application library!) and knew they were greedy and stupid, but I wasn't counting on raw, unfettered eeeeeevil.

Re:Most ISPs have blocked it

[Anonymous Coward]

two more on this side of the pond. Portugal's largest dial and ADSL ISPs have both patched their DNS resolvers to block this.

Re:Pert Peeve

[Anonymous Coward]

To get a domain.com.au address, the "domain" part has to have something to do with your registered company name, at least it did last time I checked. It seems to work well, IMHO.

Re:Most ISPs have blocked it

[jms]

Speakeasy appears to have blocked the "feature".

BIND patch available to block site finder

[Anonymous Coward]

The Internet Software Consortium (ICS), which makes the Berkeley Internet Name Domain (BIND) software (runs most domain name servers) has already released a patch to block "site finder":
http://www.isc.org/products/BIND/delegation-only.h tml [isc.org]
I just still can't believe Verisign thought they could get away with this.

link with more info...

[Anonymous Coward]

More info can be found here:

http://www.popluarenterpirses.com/ [popluarenterpirses.com]

Re:Null space needs to remain null

[kfg]

"It makes me wonder if someone has a patent on silence yet?"

No, there's too much prior art, but John Cage has a copyright on 4'33" of it.

KFG

Re:Most ISPs have blocked it

[Dominic_Mazzoni]

It's blocked for me. The cable is provided by Time Warner, but the Internet connection by RoadRunner, so I'm assuming that RoadRunner is the one blocking it...

Re:Most ISPs have blocked it

[Xenoproctologist]

To be more specific, Adelphia has blocked the IP of the Shitefinder website. They haven't patched their DNS servers to return NXDOMAIN on *.TLD.

Re:Most ISPs have blocked it

[MattCohn.com]

Comcast has also not blocked this.

Re:Most ISPs have blocked it

[Anonymous Coward]

Vector Internet Services Incorporated [visi.com] is currently testing their anti-SiteFinder solution before rolling it into production. It's been on the cooker since about 0600 UTC on Wednesday.

Mike Horwath, senior admin, called Verisign's actions "offensive". Concise, yet very descriptive. :-)

Re:BIND patch available to block site finder

[StarHeart]

There is a bug in this patch. There is already talk of releasing another patch.

The bug is that NS lookups for non-cached domains fails.

nslookup
set type=ns
geek.com
Fails if not already cached by named

nslookup
geek.com
set type=ns
geek.com
Always works

Re:Most ISPs have blocked it

[zwoelfk]

OK - I can verify that nifty (a very large provider) here in Japan does not block it. To make it worse, Verisign's page seems to be only available in English (Well, at least not Japanese), so now many people are getting redirected to pages they can't even read. At least Microsoft's version of this was localized.

Copy of the Lawsuit and More Details

[dmehus]

Full details of the lawsuit are available in this press release:
home.businesswire.com/portal/site/google/index.jsp ?epi-content=GENERIC&newsId=20030918005730&newsLan g=en&beanID=478837757&viewID=news_view [businesswire.com]

Copy of lawsuit:
search.netster.com/about/lawsuit.asp [netster.com]

Sorry, I forgot to include these links in my submission. Post away!

Cheers,
Doug

Re:Pert Peeve

[kubrick]

That requirement has been relaxed lately; they're pretty loose about it now, and auDA just require that it be 'related to your business operations'. Not quite the free-for-all that .com/.net/.org is...

Re:Most ISPs have blocked it

[StarHeart]

All the bind patches, including ISC, that I have tried have bugs. I think ISC will be coming out with a new patch soon.

Re:I dunno about that.

[Agent R]

This litigation might work since Popular Enterprises still has to *buy* the expired domain first. With Verisign doing this for free they get a big leg-up on it. Either way I hope Verisign loses for this blatant RFC violation. This is fast becoming as something more than an annoyance.

Re:I'm not surprised...

[Anonymous Coward]

when the url is decoded it is

http://sitefinder.verisign.com/lpc?url='//--></scr ipt>"//--></script>><font size="
+3"><b>If <em>she</em> loves us then we <em>have</em> to be cool!<br>
<img src="http://www.patrick.fm/boobies/boobies.php/tex t/VeriSign"><br>VeriSign! Hot
babes love us! You should too!<br><br><br><br></font&g t ;|

basically there is a point in the code where the cgi paramater url is assigned to a javascript variable. All that has to happen is close the js var declaration, html comment, and script tag.

http://sitefinder.verisign.com/lpc?url="//--></scr ipt>malicious code<script>

script at end opens another script tag for the original /script tag to work with, it also hides the rest of the javascript

try these links

Obligatory hello world example [verisign.com]

Micro$oft [verisign.com]

and a goatse.cx [verisign.com] version

Re:Most ISPs have blocked it

[dammitallgoodnamesgo]

Yahoo BB (another huge Japanese ISP) also aren't blocking it.

Re:"Unfair advantage"?

[Anonymous Coward]

However, Mountain View's objection is that doing ... Or, put another way, Mountain View would be perfectly satisfied if

Umm ... guys ... I know it is late but you need to reparse the sentence. Mountain View is the California city in which Verisign is based. The litigant is Popular Enterprises, LLC.

--
Concerned about your network security? Try the free Nmap Security Scanner [insecure.org]

Re:Nice tactic.

[nocomment]

Don't forget the petition!!! Go sign it.

http://www.petitiononline.com/icanndns/ [petitiononline.com]

Alexa

[Anonymous Coward]

Alexa Page Ranking, another insidious tool, lists Verisign Pagefinder as the number one Website in new Hits, up 1360 % on the week

http://www.alexa.com/site/ds/movers_shakers

Re:"Unfair advantage"?

[Anonymous Coward]

This actually causes LARGE problems for people operating over VPN connections.

People do a request for a site, e.g. intranet.internal.foo.org.

The external DNS servers fail in that they don't come back with an answer, and then the client continues through its list of DNS servers until it gets to the internal servers where it gets an answer.

If this is the way your VPN systems are set up, then they are set up wrong! The setup you have never was secure or safe because someone could've registered the domains you're hoping won't exist anyway.

The correct way to do this is to use a search order. That's why /etc/resolv.conf has a search directive. You put something like

search internal.foo.org foo.org

and then when you look up "intranet", it will first try "intranet.internal.foo.org.", then "intranet.foo.org.", and THEN stuff that exists in the outside world.

Of course, not all operating systems have /etc/resolv.conf, but if they don't have something equally good, then they're broken and insecure...

Cross Site Scripting Bug

[umofomia]

http://www.";alert("fuckverisign");".com

The parent post may be modded as "Funny" but this actually is a pretty serious cross-site scripting bug introduced by Verisign. This and the hard-coded SMTP replies bug show how little thought Verisign put into the ramafications of their changes. Seriously... if you're gonna hijack the Internet, at least do it right!!

Re:what the fuck?

[nacturation]

Don't like it, don't agree with it, but acknowledge their right to use the service they faught for and won. If you can't take it, fight the fight to give them (better) competition, instead of filing some frivolous lawsuit.

Yes, thank you Ayn Rand. And how do you give them competition? Ask them to relinquish control of their root servers and institute yours in their place? Or maybe start a whole new internet? Yeah, that's going to work.

Let's face it. Verisign broke the rules (ie: RFCs) which were designed to govern how the internet infrastructure works. Rules which they implicitly agreed to in attaining their position of power.

However, perhaps you're right. They 'fought' for their position, so anything is within their rights. Why, if they suddenly decided to randomly redirect people's existing websites to a Verisign information page, I guess that's ok. After all, one can always fight to give them better competition by creating one's own separate internet.

not quite

[Anonymous Coward]

Owning a domain that wasn't in DNS used to be called a "lame delegation".

Not quite. Owning a domain is a separate issue from DNS. Owning a domain means you have an entry in a domain registry. It does not mean you have a DNS entry. Owning a domain means you have paid your money and signed up and that you have the right to have your domain added to the DNS.

A lame delegation is something different. A lame delegation is when there are NS records that exist in the DNS, but they point to the address of a server that can't answer the queries for that domain. In contrast, if you have a domain that isn't in DNS, there is no NS record at all.

to [e-mail]

[aaron_pet]

Hi

Whenever somebody miispells my internet address, they end up going to sitefnder.veirsign.com!

This is extremely difficult on my disabled users who frequently mispell my sight name, and rely on their browsers error message to know what happened.

They also don't appreciate that the closest match for the common mispellings are an adult site!, but that is besides the point.

As my main web site makers, what can you do? I'd hate having to go with another web design ferm, I trust that you can fix this... was it an upgrade to Windows 2003 that caused this problem? I've heard some bad things about that... but Microsoft patches their stuff pretty quickly.

Fred is out for the moment, had a horrible car accident, I'm corrisponding for him. Thanks!
-Aaron Peterson
[e-mail]
509 332 7697

how to call Verisign and complain

[chongo]

n addition to a number of already posted suggestions, I recommend that you call Verisign and file a complain:

[phone] (worldwide)
[phone] (toll free US/Canada)

When you call, select:

* 1 (purchase an product or renew an exist product)
* then 7 (all other questions)

I recommend that you be patient with the Verisign rep that answers the phone. That person may not fully understand the issue / problem, and they are unlikely to personally be responsible for the Verisign decision. Remember that you are objecting what Verisign as a company is doing. Don't yell at the rep. Be polite but firm.

Ask Verisign to stop the wildcarding now. Explain why what they are doing is wrong (such as being unable to determine of a EMail message is being sent from a bogus / non-existent domain because thisdomaindoesnotexist.com resolves to 64.94.110.11).

If you do business with Verisign now, tell them that you will switch vendors unless Verisign stops this practice in X weeks. (fill in the X)

You might want to leave your phone number and request a callback. Anonymous complaints do not go as far.

If you are in the US, you might want to contact your local member of congress and object about what Verisign is doing. Let Verisign know that you are doing this when you call.

Yes, they might flush your complaint down /dev/null. But I suspect that pressure from all fronts might help. I have been told (off the record) that some people within Verisign are not happy with their wildcarding. Complaints get logged into a database that these people can review. Your complaints, in volume, might help those folks make a stronger case against top-level wildcarding.

Re:Most ISPs have blocked it

[wizman]

I am the network engineer & co-owner of a small ISP (coastalwave.net) in northern Ohio, with a coverage area of 5 counties or so via wireless. I have null routed the IP address, and will be switching to patched dnscache & bind when I have a chance.

One of our two upstreams (Amplex.net) has redirected traffic to that IP to their own internal site, with a link to a google search and a link explaining the controversy.

how to complain about Verisign to ICANN

[chongo]

In addition to signing the:

online petition [petitiononline.com]

you can file a complaint about Verisign to ICANN by using their:

Registrar Problem Report Form [internic.net]

Partial Windows Fix

[goofy183]

If your on a windows machine there is an easy fix for PART of the problem. Just go into your hosts file:

C:\WINDOWS\system32\drivers\etc\hosts
or
C:\WI NNT\system32\drivers\etc\hosts

and add the line
0.0.0.0 sitefinder.verisign.com

Now this won't fix the DNS resolution problems but it will at least stop your browser from hitting the sitefinder page.

Re:How come noone complains about other TLDs?

[David Byers]

You got it in one.

Those domains have been set up that way for years. I wager they've been set up since those ccTLDs became popular. And they don't respond to SMTP connections.

The com and net gTLDs have *not* been set up that way for year and we really don't want them to be.

Sitefinder.verisign.com has a web bug

[Yer Mum]

There's a 1x1 gif image in the sitefinder page, this is the URL that refers to it...

http://verisignwildcard.112.2o7.net/b/ss/verisig nw ildcard/1/G.2-Verisign-S/s75019259531159?[AQB]&ndh =1&t=19/8/2003%2018%3A54%3A6%205%20-60&pageName=La nding%20Page&ch=landing&server=US%20East&c1=NOTHIN G&c2=NOTHING%20%2800/00%29&c3=NOTHING%20%28DYM%29& c12=No&c13=00&c14=No&c15=00&c16=Yes&c17=15&c22=NOT %20SET&g=http%3A//sitefinder.verisign.com/index.js p&s=1024x768&c=16&j=1.3&v=Y&k=Y&bw=1024&bh=614&p=R ealPlayer%28tm%29%20G2%20LiveConnect-Enabled%20Plu g-In%20%2832-bit%29%20%3BWindows%20Media%20Player% 20Plug-in%20Dynamic%20Link%20Library%3BShockwave%2 0Flash%3BShockwave%20for%20Director%3BMicrosoft%C2 %AE%20Windows%20Media%20Services%3BAdobe%20Acrobat %3BMozilla%20Default%20Plug-in%3BJava%20Plug-in%3B QuickTime%20Plug-in%206.0.2%3B&[AQE]

Why would they want to know my plugins and screen size, amongst other things?

Oh well, not to difficult to get Mozilla to block that at the cookie it sets.

terms of use

[endx7]

Heh, http://sitefinder.verisign.com/terms.jsp is an interesting read.

I had to modify the following a bit from the original. Slashdot wouldn't let me post it as it was (Lameness filter encountered. Post aborted! Reason: Don't use so many caps. It's like YELLING.)

Sole Remedy.

your use of the verisign services is at your own risk. if you are dissatisfied with any of the materials, results or other contents of the verisign services or with these terms and conditions, our privacy statement, or other policies, your sole remedy is to discontinue use of the verisign services or our site.

And just how am I supposed to stop using this? It's kinda forced upon me (besides not using the net at all...).

VeriSign is not the only one

[Anonymous Coward]

NeuStar, which exclusively controls the .biz and .us domains, has been using a similar service on and off since June. They have been attempting to divert the typo traffic to a paid search engine for profit, and have made money doing so. Originally, they had been collaborating with VeriSign for months behind closed doors to create a service like SiteFinder, but they were unable to agree on who got what money, and the joint deal never happened - they went their own ways.

VeriSign built their own system, which obviously works fine. NeuStar has no such resources or knowledge, and outsourced the building of their system. Unfortunately for them, it is plagued with problems and has never worked right, because they partnered with a couple of morons to build the system for them (an ex-journalist and an ex-IT manager, who thought they could build an 'Internet' company) The NeuStar system is not currently running, because it screwed up the NeuStar .biz and .us DNS servers, but it has been running on and off for months.

Just a little FYI about other registries already using a SiteFinder-like service, from a developer at a company the morons tried to hire to help them fix the broken service they built for NeuStar. Naturally, we declined to help them try and steal web traffic for profit.

As far as ICANN goes, they knew the registries (both VeriSign and NeuStar and others) were building projects to intercept and sell mis-typed domain traffic. VeriSign and NeuStar legal teams had even met with ICANN to discuss the feasibility of the projects. ICANN agreed with the concept, and to 'see how it goes once implemented'. Their recent silence followed by the 'advisory' is simply their attempt to over themselves after the fact - they knew it was coming, and conceptually bought off on the idea.

So there you have it, from an insider. I guess next time you should have us sign NDA's, morons.