Post: Working on DNS bypass

(adsbygoogle = window.adsbygoogle || []).push({}); Since I can't reply yet to other related posts I'll start a new.
(Mods, you can move this if you want)

Things I've done so far:

Used own dns to fake following domain names:
cdn.update.playstation.net
np.stun.playstation.net
ps3.update.playstation.net
dl.playstation.net
vo.llnwd.net

They all point to my own server (apache)

Also configured squid to redirect You must login or register to view this content. to my server, since for some reason the ps3 does bypass my dns the 2nd time it tries.

I use following ps3-updatelist.txt:

    

 cat /var/www/update/ps3/list/eu/ps3-updatelist.txt

# EU

Dest=85;CompatibleSystemSoftwareVersion=3.5500-;

Dest=85;ImageVersion=0000b99c;SystemSoftwareVersion=3.5500;CDN=You must login or register to view this content.

This is the access.log from squid when I boot the ps3:

    

1297264108.259      0 xxx.xxx.xxx.xxx TCP_DENIED/302 442 GET You must login or register to view this content. - NONE/- text/html

1297264108.268      0 xxx.xxx.xxx.xxx TCP_MEM_HIT/200 630 GET You must login or register to view this content. - NONE/- text/plain

1297264111.669    738 xxx.xxx.xxx.xxx TCP_MISS/200 3455 CONNECT auth.np.ac.playstation.net:443 - DIRECT/199.108.4.73 

This is what happens if you logon manually after boot:

    

1297264214.516      3 xxx.xxx.xxx.xxx TCP_MISS/404 683 GET You must login or register to view this content. - DIRECT/xxx.xxx.xxx.xxx text/html

1297264215.084      2 xxx.xxx.xxx.xxx TCP_MISS/404 683 GET You must login or register to view this content. - DIRECT/10.252.19.1 text/html

1297264215.894      2 xxx.xxx.xxx.xxx TCP_MISS/404 679 GET You must login or register to view this content. - DIRECT/xxx.xxx.xxx.xxx text/html

1297264216.773    731 xxx.xxx.xxx.xxx TCP_MISS/200 3455 CONNECT auth.np.ac.playstation.net:443 - DIRECT/199.108.4.73 -

1297264218.164    740 xxx.xxx.xxx.xxx TCP_MISS/200 3455 CONNECT auth.np.ac.playstation.net:443 - DIRECT/199.108.4.73 -

1297264218.581     23 1xxx.xxx.xxx.xxx TCP_MISS/504 0 CONNECT nsx.sec.np.dl.playstation.net:443 - DIRECT/xxx.xxx.xxx.xxx -

1297264223.784      0 xxx.xxx.xxx.xxx TCP_DENIED/302 442 GET You must login or register to view this content. - NONE/- text/html

1297264223.794      0 xxx.xxx.xxx.xxx TCP_MEM_HIT/200 631 GET You must login or register to view this content. - NONE/- text/plain

PS3 comes up with update message.
When saying yes, it come's back saying my ps3 is up to date.

I also blocked all ports except 80 and 443 for the ps3 before boot, but then nothing works.

Blocking all but 80 and 443 after boot results in a longer attempt to logon, but then fails with error 80710092

So something is communicating over a non standard port with sony.

I'll try to change my network so I sniff the traffic, as now the ps3 is connected over wireless and wireshark runs on the wired part.

BTW:
anyone an idea what this link does:
You must login or register to view this content.

BTW2: As I read in many other posts here, if you don't know what yo are talking about, don't bother reply-ing (Like someone posted an ip address is only in this format xxx.xxx.xx.x /facepalm)