Geek Answers Handbook

Why is my .Net application communicating with Verisign?

I wrote a .Net application that has nothing to do with network connectivity. There is not a single line of code in the entire application using the network adapter, but my firewall caught trying to contact Verisign for some reason when starting the application. This does not occur regularly; in fact, this happened only twice.

Last time, I was able to launch Wireshark before informing the firewall about permission to access the network. I can say that there is no real data transfer . It captured only 9 TCP packets: some SYN packets, some SYN / ACK and some RST packets (RST packets were damaged). I would suspect one of my third-party DLLs, but I don’t understand why the math library or image manipulation library tried to establish a connection with Verisign and then do nothing with this connection.

My clients are in tight security organizations; the last thing I want is a phone call asking why my application is connecting to the Internet.

Does anyone know why this is happening? Is there any way to prevent this?

The .pcap file created by Wireshark is here .

+7
networking startup unauthorized verisign
source share
5 answers

Here is a good blog link explaining what is happening and changes to the application’s configuration file that you can add to stop it, namely:

<configuration> <runtime> <generatePublisherEvidence enabled="false"/> </runtime> </configuration>

This is due to the original signature and to the publisher, which you almost certainly don't need. It is explained here by MSDN.

It should be noted that .Net 2.0 and .Net 3.0 added support for this configuration setting using Service Pack 1 (SP1). Net 3.5 supports this without any service pack.

+8
source share

If you sign the assembly with a real certificate, the .net runtime should verify the digital signature.

+2
source share

If it is an SSL web application, IE may try to verify that the certificate has not been revoked.

+1
source share

Are any of the third-party DLLs signed with Authenticode ?

+1
source share

Are these paid third-party DLLs that possibly perform some kind of authentication of use?

0
source share

More articles:


All Articles