Why is my .Net app contacting Verisign?

Question

I wrote a .Net application that has nothing to do with network communication. There is not a single line of code in the whole application that uses the NIC, but my firewall has caught it trying to contact Verisign for some reason when the app starts. This does not happen regularly; as a matter of fact, it has only happened twice.

The last time it happened, I was able to launch Wireshark before telling my firewall to allow access to the network. There was no real data transfer that I can tell. It only captured 9 TCP packets: some SYN packets, some SYN/ACK, and some RST packets (The RST packets were broken). I would suspect one of my third-party dlls, but I don't see why a math library or an image manipulation library would try to establish a connection with Verisign and then do nothing with that connection.

My clients are in organizations with tight security; the last thing I want is a phone call asking why my application is connecting to the Internet.

Does anyone know why this is happening? Is there a way to prevent it from happening?

The .pcap file that Wireshark generated is here.

Fornax

Answer 1

Here's a good link a blog explaining what's happening, and the changes to your application config file you can add to stop it from happening, specifically:

<configuration>
   <runtime>
       <generatePublisherEvidence enabled="false"/>
   </runtime>
</configuration>

It's related to authenticode signing, and the PublisherMembershipCondition which you almost definitely don't need. That's explained here on MSDN

A thing to note is that .Net 2.0 and .Net 3.0 only added support for this config setting with SP1. .Net 3.5 supports this without any service pack.

Philippic

Answer 2

If you sign your assembly with a real certificate, the .net runtime has to check the digital signature.

Differentiate

Answer 3

If it's a web app with SSL, it could be IE trying to verify that the certificate hasn't been revoked.

Chrysolite

AFAIK, the same can be true for any signed .net assemblies, not necessarily connected to IE or web apps. The system would contact a Certificate Revocation List (CRL) server to check if anything shall not be trusted anymore. There is a system-wide option to disable this behaviour, but I can't remember where is it. – Foch

Answer 4

Are any of the 3rd party DLLs signed with Authenticode?

Goltz

Answer 5

Are these paid third party dlls which are possibly doing some sort of usage authentication?

Sacrilege

They are paid, but their licensing mechanism consists of looking for a license key included in a file on the computer. – Fornax

Well, that's one licensing mechanism. The other one doesn't seem to have a license verification mechanism. – Fornax