Bugtraq mailing list archives

Re: Anyone can take over virtually any domain on the net...


From: cmadams () HIWAAY NET (Chris Adams)
Date: Thu, 13 Jan 2000 13:09:04 -0600


Once upon a time, Thomas Reinke <reinke () E-SOFTINC COM> said:
BTW, Network Solution's instructions on changing the
scheme to a userid and password based system doesn't
work very well. We've attempted on several occasions
to do this with no luck...thereby forcing on us the guardian
scheme :(

I've setup contacts with CRYPT-PW authentication, and they ignore it.
We had a domain hijacked a month or two ago (someone changed the
contacts and the DNS servers), and they just forged the email headers as
coming from the old technical contact.  That contact had CRYPT-PW
authentication setup, but NetSol processed the change anyway with just
the mail From: header matching.  It then took them over 24 hours from
when we notified them to fix it (even though they reload the zone files
twice daily).

However, since AFAIK there is no way to move a domain from one registrar
to another (without letting it expire and risking losing it), they still
have en effective monopoly on all existing domain names that are
registered with them.

--
Chris Adams <cmadams () hiwaay net>
Systems and Network Administrator - HiWAAY Information Services
I don't speak for anybody but myself - that's enough trouble.



Current thread: