| PunkBuster service try to connnect to verisign.com? My firewall has detected a change in PnkBstA.exe. And now, It try to connect to this ip: 199.7.54.190. The domain of this IP is »www.verisign.com/.
Is verisign a spyware/ads site?
Maybe pb always connected to verisign in the past and I didn't notice it because I allowed pb to accces the net. And when it got updated, my firewall detected it. |
|
 Mats Here kitty and the chimp. SmashPremium
join:2002-03-16
kudos:1 | said by MAT777:Maybe pb always connected to verisign in the past and I didn't notice it because I allowed pb to accces the net. And when it got updated, my firewall detected it. This is correct..
Your firewall detected the change to punkbuster program.. |
|
|
|
| said by Mats:said by MAT777:Maybe pb always connected to verisign in the past and I didn't notice it because I allowed pb to accces the net. And when it got updated, my firewall detected it. This is correct.. Your firewall detected the change to punkbuster program.. Ok, and what is verisign and what pb has to do with it? You have an idear?
btw, I sent a ticket to evenbalance to know if this is a normal activity for pb or not. |
|
 NetFixerFreedom is NOT freePremium
join:2004-06-24
The 'Boro | Th IP address you posted is one of several crl.verisign.com addresses which are used to check SSL certificate validity. |
|
Mats Here kitty and the chimp. SmashPremium
join:2002-03-16
kudos:1 | reply to MAT777
said by MAT777:Ok, and what is verisign »en.wikipedia.org/wiki/VeriSign |
|
| reply to NetFixer
said by NetFixer:Th IP address you posted is one of several crl.verisign.com addresses which are used to check SSL certificate validity. Do you know why pb has to check for a ssl certificate validity? |
|
| reply to Mats
Yes I have read this before coming here.
"VeriSign also provides a variety of security and telecom services"
This is kind of vast to know what they do. Are they a ad/spyware compagny under the cover of ssl certificate? |
|
Mats Here kitty and the chimp. SmashPremium
join:2002-03-16
kudos:1 | No they arent..
I could never give you an explanation that you would understand.. Hopefully someone will come in soon who can.. |
|
 jimkyleBtrieve GuyPremium
join:2002-10-20
Oklahoma City, OK
kudos:2
 ·AT&T Southwest
| Verisign was originally known as Network Solutions Inc., and was the original issuer of almost all URL names. It's still the registrar for *.com domains; if you have a dot-com domain registered anywhere else, your registrar is simply acting as Verisign's agent.
However the company's hat is not pure white. A few years ago they implemented a change to their service such that if a mis-typed address could not be found in their database, you would be redirected to their own search engine. This caused a firestorm of controversy and they undid their change. However many of us still do not trust the firm completely; the feeling was (and is) that any violation of the standards indicates that future violations may occur.
The reason any program would contact them to verify that a certificate is valid is that the program is "signed" by its maker to assure that it has not been forged. Some operating systems refuse to allow an unsigned program to install or run, but the only way to verify a program signature is to check it out with the original provider -- in this case Verisign.
--
Jim Kyle |
|
2 edits | So if I understand well, maybe pb is checking if the exe has not been hacked(forged?) on that site? That's how pb detect cheating? Looking at the amount of cheaters, this doesn't appear to work well 
Is this the same certificate windowsxp ask you sometimes when you install driver?
Nice information btw, when I read this: "A few years ago they implemented a change to their service such that if a mis-typed address could not be found in their database, you would be redirected to their own search engine."
I think they prove they it could be a spyware. I'm waiting for evenbalance to know if it is a normal activity or if my pb exe was infected by a virus. |
|
 SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | reply to MAT777
said by MAT777:Do you know why pb has to check for a ssl certificate validity? This is almost certainly automatic behavior by the Windows libraries, not volitional activity by punkbuster.
A CRL — Certificate Revocation List — is used to insure that certificates are still valid and have not been revoked.
When a client (which could be a browser or an application) connects to an SSL-protected resource, it verifies that the cert is valid by following the signing chain down from the roots. The result of this process is a yes/no that the cert is in fact valid.
But there is also a list of revoked certs; ones that were in fact signed (and will pass signing verification), but should nevertheless be considered invalid.
Let's say that I get an SSL cert for www.unixwiz.net from Verisign, but I foolishly allow a bad guy to get my private key and passphrase. That means he can use that cert on a fake www.unixwiz.net website. Oh snap!
So I'll revoke my certificate, which gets it put on the list maintained by crl.verisign.com. So when the Win32 secure-socket libraries verify a cert, it checks the root signing chain and to see if that cert is on the revocation list.
So it's unlikely that Punkbuster is doing anything but calling a Win32-provided library to set up a secure connection, and the library is doing all the heavy lifting.
Steve
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site |
|
1 edit | said by Steve:Let's say that I get an SSL cert for www.unixwiz.net from Verisign, If I want to understand the whole thing, I need to understand:
What the SSL cert is useful for? Why you'd get a cert? |
|
SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | said by MAT777:What the SSL cert is useful for? Why you'd get a cert? An SSL cert is an attestation of identity: if I have an SSL cert for my my website, then if the cert passes validity you can be sure that it really is my website.
You care about this when you visit your bank, insuring that they are who the URL claims them to be (I personally can't get an SSL certificate for wellsfargo.com).
Additionally, an application such as punkbuster may well need to phone home to get updates and the like: it needs to be sure that when it thinks it's hitting the made-up URL update.punkbuster.com, that it really is connecting to that site.
It's not out of the question to imagine somebody trying to subvert Punkbuster by setting up a fake update site and messing with local DNS, in an attempt to get the software to get a bogus update. But when the fake site is unable to produces a root-CA-signed update.punkbuster.com certificate, then the application knows it's not talking to the real deal.
But please note that an attestation to identity is not the same as an attestation to safety - I could set up www.FreeSpywareWithPorn.com, get a valid cert, and offer exactly what I claim. Just because the site is what it claims to be doesn't mean that it's safe.
Steve
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site |
|
1 edit | But for example, when I visit my bank site, what check the ssl certificate? Firefox?
Maybe my bank don't use this, do you have an example of a site that use a ssl certificate? |
|
SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | said by MAT777:But for example, when I visit my bank site, what check the ssl certificate? Firefox? Your web browser checks the cert: it insures that the Common Name on the certificate matches the URL in the address line, that the cert has a chain of signing from the trusted root certs, that the cert has not expired, and that the cert has not been added to a revocation list (there are other housekeeping checks too).
All online banking uses SSL: if you see https in the URL, it's using an SSL certificate.
Steve
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site |
|
| https, ok, I got it now. Thanks for all this information. |
|
2 edits | reply to MAT777
I know you guys appear to dislike old thread bump but I think it is good for everybody to know the end of this story. If I shouldn't have bump it, please tell so I won't do it again in the future.
I received the answer from evenbalance:
"Note #2: PnkBstrA shouldn't even be contacting the internet, so something is definitely not right.
Please start pbsvc.exe and run through the uninstall process. After that, run it again and run through the install process. Make sure it uninstalls/installs correctly. Reboot the computer and then try playing again. Vista users need to start it explicitly with admin rights.
Please make sure you allow the service files in security software like virus scanners and/or firewalls. You will need to allow/unblock the services PnkBstrA.exe and PnkBstrB.exe from your "C:\Windows\system32\" folder. In case of doubt, manually add both to your firewall's allow list. After the installation process you will only find PnkBstrA, so just make sure this process file is not blocked. Then try playing on a PB enabled server, in case of a kick, check if PnkBstrB was created and unblock it too."
So my firewall is bugged or a virus has infected the pb service. |
|
