Verisign, Ultimate Browser Hijack

I thought some of the folks here would like a heads up on this.

http://www.wilderssecurity.com/index.php?board=21;action=display;threadid=13995
http://www.spywareinfo.com/newsletter/archives/0903/24.php
It is the third item down.
http://slashdot.org/article.pl?sid=03/09/16/0034210&mode=thread&tid=126&tid=95&tid=98&tid=99

If you have hosts on your system add:
127.0.0.1 sitefinder.Verisign.com #Block Verisign SiteFinder
127.0.0.1 sitefinder-idn.Verisign.com #Block Verisign SiteFinder
to protect against it.

OR

Block these IP's with your firewall, or add them to the Restricted Sites Zone if IE.
12.158.80.10
64.94.110.11

 

Thanks for posting that. Good info. Sounds like VeriSign is way out of control. Hope they suffer big time for it.

Those entries are now firmly emplanted in my hosts file.

 

Might not work for much longer tho' - see this.

The cads!

 

Brett,
From your link, it appears Verisign thought they were throwing a pebble in a pond and expecting only to see only ripples.

 

brett--Used your link to ntcanuck and on the way to accessing the site, I got a very brief Download window. I have no idea what I downloaded. Modified files for that moment were Win386.swp, User.dat (both in C:\Windows) and Index(3).php (in TIF). I gather the first two are frequently updated, and I ran AdAware on the Hard Drive and Norton AV on the specific files, but I do not like unwanted Downloads. I guess I will have to see if anything untoward occurs in the next few days.

 

That's strange, Jum, but I saw no such behaviour - the link simply leads to a message board post. To put your mind at rest, the board belongs to NTCanuck and ObiWan - developers of the BIND-PE DNS server and regular contributors to the GRC discussion groups - and I’d be extremely surprised if their site contained anything nefarious!

 

brett--The old PC is still functioning today. So the prognosis is favorable.
Was a block to Verisign's behavior ever offered at
http://www.wired.com/news/technology/0,1282,60473,00.html ?

 

Yup. 'Bout a week ago.

EDIT: Sorry about the typo in the previous post, Jum!

 

Thanks, brute.