Bugtraq mailing list archives
Anyone can take over virtually any domain on the net...
From: reinke () E-SOFTINC COM (Thomas Reinke)
Date: Wed, 12 Jan 2000 00:27:18 -0500
Wired recently ran an article on the fact that someone recently hijacked a number of domains in the Network Solutions database using email spoofing. At first I thought this had to be a joke. After thinking about it, I realized that its no joke at all, and in fact quite easy to do. Step 1: Send a spoofed email to Network solutions requesting a DNS change to your own DNS server. Step 2: Wait for a short while (the amount of time it normally takes Network Solutions to send out a confirmation email request) Step 3: Send a second spoofed email confirming the request. Step 4: Have your DNS server serve the new web server address from a new webserver with your own content. Network Solutions rep quoted in the wired article: "O'Shaughnessy pointed out that Network Solutions offers more secure services. Most accounts will not need the extra security he said, but in the age of e-commerce and more vital Web services, the onus is on the registrant to see that his domain is secure." Doesn't take too much rocket science to point out that other than the obvious flaws in insecure email, the fact that confirmations to make domain changes do not carry any sort of tracking number make it possible for spoofed email to confirm illegitimate requests. I think it might be appropriate for Network Solutions to add at least THAT much reliability into their confirmation scheme so that that kind of change couldn't occur in the future... BTW, Network Solution's instructions on changing the scheme to a userid and password based system doesn't work very well. We've attempted on several occasions to do this with no luck...thereby forcing on us the guardian scheme:( Cheers, Thomas -- ------------------------------------------------------------ Thomas Reinke Tel: (905) 331-2260 Director of Technology Fax: (905) 331-2504 E-Soft Inc. http://www.e-softinc.com
Current thread:
- Misleading sense of security in Netscape, (continued)
- Misleading sense of security in Netscape Craig Ruefenacht (Jan 13)
- Re: Misleading sense of security in Netscape Jefferson Ogata (Jan 18)
- New MySQL Available Scott (Jan 13)
- BindView Security Advisory: Local Promotion Vulnerability in Windows NT 4 BindView Security Advisory (Jan 13)
- Microsoft Security Bulletin (MS00-003) Microsoft Product Security (Jan 13)
- ICQ Buffer Overflow Exploit drew copley (Jan 11)
- Re: ICQ Buffer Overflow Exploit Dennis W. Mattison (Little Wolf) (Jan 12)
- Re: ICQ Buffer Overflow Exploit Michael DeSimone (Jan 13)
- Re: ICQ Buffer Overflow Exploit Tom Schumm (Jan 14)
- Re: ICQ Buffer Overflow Exploit Simon Steed (Jan 13)
- Anyone can take over virtually any domain on the net... Thomas Reinke (Jan 11)
- Re: Anyone can take over virtually any domain on the net... Jon Lewis (Jan 13)
- Re: Anyone can take over virtually any domain on the net... Jeffrey Paul (Jan 13)
- Re: Anyone can take over virtually any domain on the net... Chris Adams (Jan 13)
- Re: Anyone can take over virtually any domain on the net... Shafik Yaghmour (Jan 13)
- Re: Anyone can take over virtually any domain on the net... Nick Lamb (Jan 15)
- Re: Anyone can take over virtually any domain on the net... Kurt Seifried (Jan 13)
- Blinding BIND to a moving domain D. J. Bernstein (Jan 12)
- Re: Blinding BIND to a moving domain Ken Gourlay (Jan 12)
- CyberCash MCK 3.2.0.4: Large /tmp hole Sheldon Young (Jan 12)
- Administrivia: ORBS Elias Levy (Jan 12)