21 ms·

Dangerous domain corp.com goes up for sale

406 points by DemiGuru 7y ago

kirstenbirgit 7y ago
OK, so a bunch of years ago, Microsoft suggested that AD domains/hosts should end in ".corp". But where does the .com part come in to the picture? Does corp.net or corp.ninja have the same type of issue?
- tempestn 7y ago
  Sounds like when you enter a name without a TLD, some aspect of Windows assumes you're looking for a .com.
  - djsumdog 7y ago
    Not just Windows itself, but a lot of software and tooling. If I'm working on my website, I have an entry in my hosts file so battlepenguin goes to a local web server. But I have to type it in with the leading http:// http:// and end with a slash, or else Firefox might automatically add a .com to the end and suddenly it's going to my production/live site and not my local copy. Some issues might have to do with the way DNS is resolved by the operating system (the Start > Run \\resource example in the article) and others by the way some applications (like web browsers) do fallbacks for unknown DNS records. Tangential: I worked at one company that had lower environments end in .dev and they started running into issues when Google purchased (and now sells) .dev domains and one of their project dependencies was hosted in an open source project repo that ended in .dev .. it had fallen out of use at the company and they just trashed the hosted zone, but I imagine at other shops, there's still domain overlap in the wild.
    - t-writescode 7y ago
      Formerly in the industry. I remember when .dev came out and I was in shock that ICANN thought that would be a good idea. They should have known better. .dev, .local, .home, .corp. I don’t know how many of those are tlds, as I’ve let all that knowledge leave me; but, there are some tlds that just should be permanently blocked from being real tlds.
      - tialaramex 7y ago
        People are idiots. The first idiot thing you can expect is that they'll deny they are idiots and will insist that you shouldn't idiot-proof things. The second is, since they're idiots, they'll hurt themselves on the things you didn't idiot proof. The .int Top Level Domain has existed since the 1980s. Nevertheless plenty of people decided they'd use names ending in .int for "internal" stuff. Then they were astonished that this doesn't work as expected. We even had to smack CAs for issuing certificates for such "internal" names back when they were allowed to do that (today CAs trusted in the Web PKI are not allowed to issue for names that aren't part of the Internet DNS hierarchy with a narrow exception for the .onion pseudo TLD).
      - crooked-v 7y ago
        > I remember when .dev came out and I was in shock that ICANN thought that would be a good idea. RFC 2606 had .test, .example, .invalid, and .localhost clearly established as the right TLDs to use in 1999. It's not ICANN's fault that random people then decided to use domains not in that list, even after being warned that those are the only TLDs guaranteed to never be used.
        t-writescode 7y ago
        The ones I'm thinking of are mostly for internal environments. It's my understanding (could be very wrong) that ICANN did a survey of some sort to see what TLDS are currently being used by companies and was intending to not release TLDs that are in that list, for backwards compatibility, at least for some time. And even if it isn't, ICANN should have known that some people weren't following the official rules, and should have adapted, to maintain compatibility. It's not that big of a list of TLDs they needed to avoid. Pragmatism is important, you know?
        tialaramex 7y ago
        Two things: 1. Stop having a parallel internal name hierarchy. This has always been a terrible idea, and effort to try to make it work less badly is unnecessary if you instead don't do it at all. IF you're EXA Metal Pole Europe and you own example.com then put the internal stuff in internal.example.com or whatever, don't put it in a "private" TLD named .example. If it's very important to you, you can use Split Horizon DNS to prevent outsiders looking up names in internal.example.com from your DNS servers. 2. Yes, measurements were made for potential TLDs and ICANN designated some potential TLDs as "High risk" and agreed not to try to delegate them (ie sell them). .corp and .home were on that list. Nevertheless you should not use these names.
    - the8472 7y ago
      > or else Firefox might automatically add a .com to the end and suddenly it's going to my production/live site and not my local copy. browser.fixup.alternate.enabled = false alternatively: browser.fixup.dns_first_for_single_words = true
    - xvector 7y ago
      Could someone tell me in what world this sort of assumption could have ever made sense? Why in God’s name would you design a system that redirects your requests like that? Are the security implications not painfully, frustratingly obvious?
      - patrec 7y ago
        Imagine a world without search engines and omni bars. This newfangled world wide web thing comes along and looks like it might become popular, but it's totally new to most people, who happen to be 99% of your customers. If they type `cnn` in the bar, chances are they want to go to cnn.com, so you make it so and don't lose most of your market share. Besides as far as painfully, frustratingly obvious security implications are concerned you have done much worse before for less end-user benefit like making your main word processing application the world's premier networked virus delivery platform.
        manquer 7y ago
        .dev is making a lot of money for example , it is not easy to argue that they/google lose money because others didn’t read the spec.
        lowercased 7y ago
        > so you make it so and don't lose most of your market share. lose it to whom though? other software that also doesn't behave the same way? And, per earlier comments, this wasn't a browser thing - this is a lower level windows hostname resolver issue.
      - pizzapill 7y ago
        This is the doing of a company that gave us Internet Explorer 6 & Office Macros. Microsoft prioritized user experience over security for the longest time of their existence and I think they had a little bit of success with it :)
  - noizejoy 7y ago
    To the best of my recollection, before the address field ended up doing double duty for web searches, the defaulting to .com happened across several browsers (never thought it was just Windows, though). — So for a while, I ended up getting .com domains, even when I had and wanted country domains, and redirected the .com to the country specific domain.
- acranox 7y ago
  This gets covered in one of my favorite conference talks. "Defcon 21 - DNS May Be Hazardous to Your Health" https://www.youtube.com/watch?v=9Sgaq6OYLX8&t=900s https://www.youtube.com/watch?v=9Sgaq6OYLX8&t=900s (skip to 15:00 if you just want the answer to your question. but the rest of the talk is brilliant) But basically when the computer can't resolve ".corp" it assumes it isn't an FQDN and starts adding other stuff to try and get an FQDN that does resolve.
  - delusional 7y ago
    It's the same reason you can't navigate to a bunch of TLDs even though the owners have configured it to serve something.
  - swiley 7y ago
    > when the computer Meaning browsers? The answer there is stop doing stupid things with the URL. When I type “localhost” into Firefox I’m not expecting a google search. If libc does that then that’s surprising and probably also wrong.
    - snazz 7y ago
      I'm pretty sure both the Win32 libc and applications do this. Try typing "http://example" http://example" into Firefox. You'll get example.com.
      - phit_ 7y ago
        mh, can't reproduce on Windows 10 and Firefox 73 get a "Server not found" page as expected
        wink 7y ago
        Win 10 and Firefox 72.0.2 here. New Private Window -> http://example http://example -> http://www.example.com/ http://www.example.com/
        bscphil 7y ago
- andrewaylett 7y ago
  DNS Search Domains are the reason: they're a mechanism for resolving a hostname to a fully-qualified name. Many companies I've worked for would (for example) have a search domain set for 'wherever.internal', so if you typed 'jira' then having failed to find the 'jira.' TLD, the local DNS resolver would then try to find 'jira.wherever.internal'. That way, you could correctly resolve hosts based on just their names and avoid extra typing. The problem comes when machines move off the corporate network but keep their search domains. Now we're making public lookups, and the network infrastructure has no idea how to resolve the names you're looking for. In an AD environment, the AD server is typically the DNS server and does know how to resolve the AD domain as a name. So the machine's lookup for 'corp' works. But move off the AD network and we're back to search domains. And apparently enough Windows machines have a '.com' in their search domains for there to be a lot of 'corp.com' lookups. Which cause the problems listed when they succeed. If you put '.net' in your search domains then corp.net would have the same issue. What I'm still not sure about is that I'd thought that you needed an _explicit_ search domain. Maybe there's enough AD servers set up to hand out '.com' as a literal search domain?
komali2 7y ago
The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security, and he has imo a good reason - Microsoft fucked up and should shoulder the responsibility. Even more incredibly is it seems some requests were coming from Microsoft owned machines. He talks about how massive fortune 500 companies may be aware of the issue but unwilling to do anything about it. So it seems, as ALWAYS, we're going to have to wait for state sponsored actors to buy the things, embarrass the shit out of a couple CEOs by posting their dick pics they're inexplicably sending over company mail, and THEN corps will start doing something about it. Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily.
- beamatronic 7y ago
  Pain is required in order for people to make change.
- mirimir 7y ago
  Indeed, one could argue that Microsoft has been encouraging its customers to effectively spoof the domain. So it's totally obvious that it ought to buy it. Still, this is the funniest thing that I've seen in months.
  - deleted 7y ago
    [deleted]
- bsder 7y ago
  > Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily. Because someone will have to cut a 7 digit check. And nobody is going to volunteer their budget for that. Until the bigwigs gets pantsed and command someone to cut the check, it simply won't happen.
- ajross 7y ago
  A more cynical interpretation is that he almost certainly tried to sell this to MS privately, and they didn't bite at the price he was asking. The public offering at $1.7M is likely an attempt to force their hand. Frankly that doesn't sound to expensive given the context, it's probably less than Microsoft's existing bug bounty budget anyway. I don't know why they couldn't work this out, or why they never bothered to try to address the issue over the multiple decades this guy has been keeping this domain out of dangerous hands. Just write the check, Satya.
gpm 7y ago
The easy resolution here would be for microsoft to push an update that does the moral equivalent of adding hosts file lines 127.0.0.1 corp.com ::1 corp.com
- gfodor 7y ago
  That's hardly a resolution, because it assumes such an update would actually be applied to all the machines in question.
  - gpm 7y ago
    If a machine is connected to the internet and not getting updates, it's fucked anyways.
  - deleted 7y ago
    [deleted]
- swiley 7y ago
  1) windows has a hosts and resolve.conf file (don’t ask me where it is but I’ve seen it and it works) 2) what are likely the most risky applications tend to ignore the libc resolver and its configuration.
  - joshuaissac 7y ago
    The Windows hosts file is usually at C:\Windows\System32\drivers\etc\hosts. Winsock was modelled after BSD, hence the resemblance in the filename. /etc/resolv.conf is available from Bash when WSL is enabled. It reflects the settings from the registry by default, but can be made to be independent of them.
    - Kaze404 7y ago
      I always wondered why it was in such an awkward location. It makes sense now.
- TimTheTinker 7y ago
wyxuan 7y ago
Wait, so if Microsoft or done legitimate company doesn't buy it then it will automatically go to cybercriminals?
- wereHamster 7y ago
  No. It's an auction. If you have 1.7+ million USD then it may go to you. You are one of the good guys, right?
  - FanaHOVA 7y ago
    Microsoft turned $43B in profits last year, I don't think they'll have an issue winning this if it's as big of a deal as the article makes it out to be.
- stingraycharles 7y ago
  It will likely auction to the highest bidder, which (in a perfect market) is the person who extracts the most value out of it. They then make a compelling case that cyber criminals are very high on that list, probably in a strategic PR attempt to scare Microsoft a bit in what could happen.
bluedino 7y ago
Couldn't some organization buy it and let the IETF control it, like .local (not really a TLD, but the idea is what counts)
- amenod 7y ago
  Sure, except - why would some organization buy it to help MS's customers? If anyone, MS is here in tight spot to either (quickly!) find another solution, or win a bidding war for the domain.
- thechao 7y ago
  The folk who’re gonna buy the .org registry seem solid; maybe they could buy it?
- skinnymuch 7y ago
  Why would some org help one of the most profitable companies in the world?
perlgeek 7y ago
I wonder if buying it and participating in bug bounties en masse would be profitable in the long run.
- snazz 7y ago
  Probably not, especially since I'm not sure what your legal footing would be in this scenario. If you weren't concerned about selling the information you found to the rightful owner, then you could almost certainly turn a profit. I'm sure criminal groups and governments would find it to be a gold mine.
  - perlgeek 7y ago
    You could always argue that somebody could MITM the company's connection to a public resolver. Still probably not quite the gold mine...
techslave 7y ago
$1.7MM. cheap, considering. honestly if I had the money I’d snatch it up
- chx 7y ago
  share your monetization idea I'm sure we can crowdfund 2M in minutes if you have a good idea. This is, after all, Y Combinator.
  - WrtCdEvrydy 7y ago
    Three step 1. Provide budget email services (your.company@corp.com) 2. Provide a company directory (corp.com/your.company) 3. Profit??
    - kevin_thibedeau 7y ago
      Sell subdomains: nissan.corp.com
      - jowsie 7y ago
        This was actually Mike's intention when he first purchased the domain, he just never got around to it.
  - Zenbit_UX 7y ago
    Blackmail and extort executives with the leaked data
    - chx 7y ago
      I am sure Michael "Big Mike" DeSantis and the like would be interested in your proposal...
quickthrower2 7y ago
I love how GoDaddy lets you add the corp.com domain, has a checkout page showing the $1690000.00 and a buy now button. It even has a promo code field, so I wonder if I can get a discount?
- michaelsbradley 7y ago
  You're funny, but I tried that with a GoDaddy account and I see no such thing. Screenshot?
  - cedricium 7y ago
    You can see a similar thing if you search "corp.com" on Namecheap: https://www.namecheap.com/domains/registration/results.aspx?domain=corp.com https://www.namecheap.com/domains/registration/results.aspx?...
    - michaelsbradley 7y ago
      Nice!
    - coolreader18 7y ago
      Name"cheap"
      - organsnyder 7y ago
        At least they wouldn't be charging an exorbitant annual registration fee on top of the purchase price.
    - chx 7y ago
      You can't add it to cart it changes into a chat button if you try.
      - crooked-v 7y ago
        Usually those 'premium'-listed domains are an integration with a third-party service, where high-value domains are handled one-on-one by individual salespeople. There's pretty extensive anti-fraud and anti-money-laundering measures involved to protect the companies involved.
013a 7y ago
I can't believe this situation. This is a guy who, by his own admission, wants it to go to Microsoft, but is also holding an auction. He could just quote Microsoft $2M and be done with this whole thing. Instead, he and this "security firm" publish a big article on one of the internet's most lauded security blogs where they outline how blown away they were with how much data was being sent to this domain. They left it open for 15 minutes and got millions of emails, passwords, etc. "Wow, bad people reading this, look at how much data you could get. You better join in on the auction. Microsoft, you seeing this? You better get in on this too. Bid often and bid well, friends." I wonder what kind of authority ICANN has in revoking domain name registrations in extreme circumstances. Microsoft fucked up here, but we're long past that being a relevant component in this discussion. This registration should be pulled out from under O’Connor and blocked from registration for 100 years.
- xvector 7y ago
  I am totally OK with the sale of this domain to anyone. He owns the domain and he has the right to sell it. Perhaps the fallout would be good for computer security, as it would stop corporations from making boneheaded security decisions. Pain seems to be the only way to make corporations evolve anyways.
  - gumby 7y ago
    I would agree except he is quoted as “fearing” it won’t go to Microsoft. He could just make that happen.
    - newnewpdro 7y ago
      Microsoft has deep enough pockets to make that happen.
    - CydeWeys 7y ago
      But it's very valuable and he wants (needs?) the money for his retirement. Microsoft may not be willing to pay up.
saghm 7y ago
> Schmidt’s findings closely mirror what O’Connor discovered in the few years corp.com was live on the Internet after he initially registered it back in 1994. O’Connor said early versions of a now-defunct Web site building tool called Microsoft FrontPage suggested corporation.com (another domain registered early on by O’Connor) as an example domain in its setup wizard. > That experience, portions of which are still indexed by the indispensable Internet Archive, saw O’Connor briefly redirecting queries for the domain to the Web site of a local adult sex toy shop as a joke. He soon got angry emails from confused people who’d also CC’d Microsoft co-founder Bill Gates. If only Gates had gotten more annoyed back then and bought the domain just to stop the emails...
gpm 7y ago
A domain isn't property that anyone has to respect. I trust my domain resolver to point me at reasonable IP addresses. Not to criminals, people trying to entice criminals, or people trying to extort corporations. I appreciate the fact that the third is likely redundant with the first in most places. I am entirely on board with just killing this domain out from under him.
- huffmsa 7y ago
  Sure, let's just steal people's property "for the public good". First its domains, then it's farms. Then you're in the breadline.
  - gpm 7y ago
    You can't steal property that doesn't exist. A domain isn't property in any standard sense of the word, or at least the properties that makes it valuable aren't. Besides which, what you're talking about is known as "eminent domain" and is already a real thing for real property. Edit: Actually in this case "civil forfeiture" (for the crime of extortion) would probably be a better analogy.
    - huffmsa 7y ago
      So digital "things" aren't real? A lot of people who've been jailed and had to pay big damage money for possessing certain combinations of bits would disagree with you. > Eminent domain Doesn't apply when it's one company that is going to face some consequences.
    - antepodius 7y ago
      A domain name is exclusive use of a region in internet name-space. Land is exclusive use of a region in 2d plane-space on earth. What you can do productively with them is up to you to figure out. Hope you're happy when the government confiscates your patent for that new widget.
      - abofh 7y ago
gist 7y ago
Fwiw the correct way for Microsoft should they decide to bid on this domain to win this auction would be for them to make initial overbids that drive the price up to prevent others simply playing a game of chicken from taking hold and getting sucked into driving the price up even more.
- pishpash 7y ago
  The correct way is to bid last and not reveal how much they'd be willing to pay.
  - gist 7y ago
    Depending on the auction venue may not be a way to 'bid last'.
wolfhumble 7y ago
Just wondering, IANAL, if Microsoft would be afraid of some type of class action lawsuit if buying the domain. Buying it could maybe be seen as taking responsibility for the error earlier committed and could open up a can of worms for Microsoft. In any case, I am sure Microsoft have their reasons for being quiet; it would be an easy problem to solve after all.
heyguys 7y ago
doesnt affect me
zupreme 7y ago
This may be, if as stated in the article, a national-security-level threat. It should be handled as such. Not an auction to the highest (perhaps even foreign) bidder.
RaceWon 7y ago
If it is such a bad risk, why doesn't one of the gazillionairs on here, or even YComb itself just write a check and park it. End of story. I would; but sadly...I haven't hit yet.
kerng 7y ago
These days its .local - we should keep an eye on that
jrumbut 7y ago
Makes me wonder what's happening over at example.com, prod.com, dev.com, ad.com, and whatever other common similar names are out there.
- pg_is_a_butt 7y ago
  AFAIK example.com is defined as an exception and no one really owns it.
- jedberg 7y ago
  Luckily example.com is reserved by IANA, so no one can register it.
- stevula 7y ago
  test.com
  - paxswill 7y ago
    In the case of people using .test as a TLD we should be safe(r); .test is a reserved TLD along with .example, .invalid, .localhost and .local (the last being reserved in the long proposed mDNS RFC).
slyall 7y ago
Amazing this sort of thing is still around. I remember there was a similar sort of problem with WPAD (Web Proxy Auto-Discovery) domains like wpad.co.uk and wpad.co.nz that was publicised back in 2007 https://www.networkworld.com/article/2289705/windows-flaw-could-steer-ie-to-hackers.html https://www.networkworld.com/article/2289705/windows-flaw-co...
ganstyles 7y ago
Oh wow, this is fun. Legitimate question: Where can I bid on this? There's no link in the article and a Google search doesn't yield anything but spam.
- Mathnerd314 7y ago
  From https://www.haven2.com/index.php/domains https://www.haven2.com/index.php/domains it seems the preferred method is email, or maybe looking up his address and sending him snail mail. It's not a formal auction. Also, the EstiBot service he links only appraises corp.com at $112k. The million dollar figure comes from Namecheap/GoDaddy but I don't think Mike will use that as a reference point.
raleighm 7y ago
He's known since 1997 (earlier?) that he has a dangerous domain. He had an offer from Microsoft "several years back" (curious how long ago) but he's holding out for something closer to "market"? I doubt he spent much money purchasing and maintaining the site over the years. Yes, Microsoft should get the purchase done at $1.7m. But O'Connor doesn't exactly come across as a saint here. Pay a "market price" for my sui generis dangerous domain or I'll sell it to the highest bidder...

406 points by DemiGuru 7y ago

OK, so a bunch of years ago, Microsoft suggested that AD domains/hosts should end in ".corp". But where does the .com part come in to the picture? Does corp.net or corp.ninja have the same type of issue?

tempestn 7y ago
Sounds like when you enter a name without a TLD, some aspect of Windows assumes you're looking for a .com.
- djsumdog 7y ago
  Not just Windows itself, but a lot of software and tooling. If I'm working on my website, I have an entry in my hosts file so battlepenguin goes to a local web server. But I have to type it in with the leading http:// http:// and end with a slash, or else Firefox might automatically add a .com to the end and suddenly it's going to my production/live site and not my local copy. Some issues might have to do with the way DNS is resolved by the operating system (the Start > Run \\resource example in the article) and others by the way some applications (like web browsers) do fallbacks for unknown DNS records. Tangential: I worked at one company that had lower environments end in .dev and they started running into issues when Google purchased (and now sells) .dev domains and one of their project dependencies was hosted in an open source project repo that ended in .dev .. it had fallen out of use at the company and they just trashed the hosted zone, but I imagine at other shops, there's still domain overlap in the wild.
  - t-writescode 7y ago
    Formerly in the industry. I remember when .dev came out and I was in shock that ICANN thought that would be a good idea. They should have known better. .dev, .local, .home, .corp. I don’t know how many of those are tlds, as I’ve let all that knowledge leave me; but, there are some tlds that just should be permanently blocked from being real tlds.
    - tialaramex 7y ago
      People are idiots. The first idiot thing you can expect is that they'll deny they are idiots and will insist that you shouldn't idiot-proof things. The second is, since they're idiots, they'll hurt themselves on the things you didn't idiot proof. The .int Top Level Domain has existed since the 1980s. Nevertheless plenty of people decided they'd use names ending in .int for "internal" stuff. Then they were astonished that this doesn't work as expected. We even had to smack CAs for issuing certificates for such "internal" names back when they were allowed to do that (today CAs trusted in the Web PKI are not allowed to issue for names that aren't part of the Internet DNS hierarchy with a narrow exception for the .onion pseudo TLD).
    - crooked-v 7y ago
      > I remember when .dev came out and I was in shock that ICANN thought that would be a good idea. RFC 2606 had .test, .example, .invalid, and .localhost clearly established as the right TLDs to use in 1999. It's not ICANN's fault that random people then decided to use domains not in that list, even after being warned that those are the only TLDs guaranteed to never be used.
      - t-writescode 7y ago
        The ones I'm thinking of are mostly for internal environments. It's my understanding (could be very wrong) that ICANN did a survey of some sort to see what TLDS are currently being used by companies and was intending to not release TLDs that are in that list, for backwards compatibility, at least for some time. And even if it isn't, ICANN should have known that some people weren't following the official rules, and should have adapted, to maintain compatibility. It's not that big of a list of TLDs they needed to avoid. Pragmatism is important, you know?
        tialaramex 7y ago
        Two things: 1. Stop having a parallel internal name hierarchy. This has always been a terrible idea, and effort to try to make it work less badly is unnecessary if you instead don't do it at all. IF you're EXA Metal Pole Europe and you own example.com then put the internal stuff in internal.example.com or whatever, don't put it in a "private" TLD named .example. If it's very important to you, you can use Split Horizon DNS to prevent outsiders looking up names in internal.example.com from your DNS servers. 2. Yes, measurements were made for potential TLDs and ICANN designated some potential TLDs as "High risk" and agreed not to try to delegate them (ie sell them). .corp and .home were on that list. Nevertheless you should not use these names.
  - the8472 7y ago
    > or else Firefox might automatically add a .com to the end and suddenly it's going to my production/live site and not my local copy. browser.fixup.alternate.enabled = false alternatively: browser.fixup.dns_first_for_single_words = true
  - xvector 7y ago
    Could someone tell me in what world this sort of assumption could have ever made sense? Why in God’s name would you design a system that redirects your requests like that? Are the security implications not painfully, frustratingly obvious?
    - patrec 7y ago
      Imagine a world without search engines and omni bars. This newfangled world wide web thing comes along and looks like it might become popular, but it's totally new to most people, who happen to be 99% of your customers. If they type `cnn` in the bar, chances are they want to go to cnn.com, so you make it so and don't lose most of your market share. Besides as far as painfully, frustratingly obvious security implications are concerned you have done much worse before for less end-user benefit like making your main word processing application the world's premier networked virus delivery platform.
      - manquer 7y ago
        .dev is making a lot of money for example , it is not easy to argue that they/google lose money because others didn’t read the spec.
      - lowercased 7y ago
        > so you make it so and don't lose most of your market share. lose it to whom though? other software that also doesn't behave the same way? And, per earlier comments, this wasn't a browser thing - this is a lower level windows hostname resolver issue.
    - pizzapill 7y ago
      This is the doing of a company that gave us Internet Explorer 6 & Office Macros. Microsoft prioritized user experience over security for the longest time of their existence and I think they had a little bit of success with it :)
- noizejoy 7y ago
  To the best of my recollection, before the address field ended up doing double duty for web searches, the defaulting to .com happened across several browsers (never thought it was just Windows, though). — So for a while, I ended up getting .com domains, even when I had and wanted country domains, and redirected the .com to the country specific domain.
acranox 7y ago
This gets covered in one of my favorite conference talks. "Defcon 21 - DNS May Be Hazardous to Your Health" https://www.youtube.com/watch?v=9Sgaq6OYLX8&t=900s https://www.youtube.com/watch?v=9Sgaq6OYLX8&t=900s (skip to 15:00 if you just want the answer to your question. but the rest of the talk is brilliant) But basically when the computer can't resolve ".corp" it assumes it isn't an FQDN and starts adding other stuff to try and get an FQDN that does resolve.
- delusional 7y ago
  It's the same reason you can't navigate to a bunch of TLDs even though the owners have configured it to serve something.
- swiley 7y ago
  > when the computer Meaning browsers? The answer there is stop doing stupid things with the URL. When I type “localhost” into Firefox I’m not expecting a google search. If libc does that then that’s surprising and probably also wrong.
  - snazz 7y ago
    I'm pretty sure both the Win32 libc and applications do this. Try typing "http://example" http://example" into Firefox. You'll get example.com.
    - phit_ 7y ago
      mh, can't reproduce on Windows 10 and Firefox 73 get a "Server not found" page as expected
      - wink 7y ago
        Win 10 and Firefox 72.0.2 here. New Private Window -> http://example http://example -> http://www.example.com/ http://www.example.com/
      - bscphil 7y ago
andrewaylett 7y ago
DNS Search Domains are the reason: they're a mechanism for resolving a hostname to a fully-qualified name. Many companies I've worked for would (for example) have a search domain set for 'wherever.internal', so if you typed 'jira' then having failed to find the 'jira.' TLD, the local DNS resolver would then try to find 'jira.wherever.internal'. That way, you could correctly resolve hosts based on just their names and avoid extra typing. The problem comes when machines move off the corporate network but keep their search domains. Now we're making public lookups, and the network infrastructure has no idea how to resolve the names you're looking for. In an AD environment, the AD server is typically the DNS server and does know how to resolve the AD domain as a name. So the machine's lookup for 'corp' works. But move off the AD network and we're back to search domains. And apparently enough Windows machines have a '.com' in their search domains for there to be a lot of 'corp.com' lookups. Which cause the problems listed when they succeed. If you put '.net' in your search domains then corp.net would have the same issue. What I'm still not sure about is that I'd thought that you needed an _explicit_ search domain. Maybe there's enough AD servers set up to hand out '.com' as a literal search domain?

komali2 7y ago

The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security, and he has imo a good reason - Microsoft fucked up and should shoulder the responsibility. Even more incredibly is it seems some requests were coming from Microsoft owned machines. He talks about how massive fortune 500 companies may be aware of the issue but unwilling to do anything about it. So it seems, as ALWAYS, we're going to have to wait for state sponsored actors to buy the things, embarrass the shit out of a couple CEOs by posting their dick pics they're inexplicably sending over company mail, and THEN corps will start doing something about it. Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily.

beamatronic 7y ago
Pain is required in order for people to make change.
mirimir 7y ago
Indeed, one could argue that Microsoft has been encouraging its customers to effectively spoof the domain. So it's totally obvious that it ought to buy it. Still, this is the funniest thing that I've seen in months.
- deleted 7y ago
  [deleted]
bsder 7y ago
> Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily. Because someone will have to cut a 7 digit check. And nobody is going to volunteer their budget for that. Until the bigwigs gets pantsed and command someone to cut the check, it simply won't happen.
ajross 7y ago
A more cynical interpretation is that he almost certainly tried to sell this to MS privately, and they didn't bite at the price he was asking. The public offering at $1.7M is likely an attempt to force their hand. Frankly that doesn't sound to expensive given the context, it's probably less than Microsoft's existing bug bounty budget anyway. I don't know why they couldn't work this out, or why they never bothered to try to address the issue over the multiple decades this guy has been keeping this domain out of dangerous hands. Just write the check, Satya.

gpm 7y ago

The easy resolution here would be for microsoft to push an update that does the moral equivalent of adding hosts file lines 127.0.0.1 corp.com ::1 corp.com

gfodor 7y ago
That's hardly a resolution, because it assumes such an update would actually be applied to all the machines in question.
- gpm 7y ago
  If a machine is connected to the internet and not getting updates, it's fucked anyways.
- deleted 7y ago
  [deleted]
swiley 7y ago
1) windows has a hosts and resolve.conf file (don’t ask me where it is but I’ve seen it and it works) 2) what are likely the most risky applications tend to ignore the libc resolver and its configuration.
- joshuaissac 7y ago
  The Windows hosts file is usually at C:\Windows\System32\drivers\etc\hosts. Winsock was modelled after BSD, hence the resemblance in the filename. /etc/resolv.conf is available from Bash when WSL is enabled. It reflects the settings from the registry by default, but can be made to be independent of them.
  - Kaze404 7y ago
    I always wondered why it was in such an awkward location. It makes sense now.
TimTheTinker 7y ago

wyxuan 7y ago

Wait, so if Microsoft or done legitimate company doesn't buy it then it will automatically go to cybercriminals?

wereHamster 7y ago
No. It's an auction. If you have 1.7+ million USD then it may go to you. You are one of the good guys, right?
- FanaHOVA 7y ago
  Microsoft turned $43B in profits last year, I don't think they'll have an issue winning this if it's as big of a deal as the article makes it out to be.
stingraycharles 7y ago
It will likely auction to the highest bidder, which (in a perfect market) is the person who extracts the most value out of it. They then make a compelling case that cyber criminals are very high on that list, probably in a strategic PR attempt to scare Microsoft a bit in what could happen.

bluedino 7y ago

Couldn't some organization buy it and let the IETF control it, like .local (not really a TLD, but the idea is what counts)

amenod 7y ago
Sure, except - why would some organization buy it to help MS's customers? If anyone, MS is here in tight spot to either (quickly!) find another solution, or win a bidding war for the domain.
thechao 7y ago
The folk who’re gonna buy the .org registry seem solid; maybe they could buy it?
skinnymuch 7y ago
Why would some org help one of the most profitable companies in the world?

perlgeek 7y ago

I wonder if buying it and participating in bug bounties en masse would be profitable in the long run.

snazz 7y ago
Probably not, especially since I'm not sure what your legal footing would be in this scenario. If you weren't concerned about selling the information you found to the rightful owner, then you could almost certainly turn a profit. I'm sure criminal groups and governments would find it to be a gold mine.
- perlgeek 7y ago
  You could always argue that somebody could MITM the company's connection to a public resolver. Still probably not quite the gold mine...

techslave 7y ago

$1.7MM. cheap, considering. honestly if I had the money I’d snatch it up

chx 7y ago
share your monetization idea I'm sure we can crowdfund 2M in minutes if you have a good idea. This is, after all, Y Combinator.
- WrtCdEvrydy 7y ago
  Three step 1. Provide budget email services (your.company@corp.com) 2. Provide a company directory (corp.com/your.company) 3. Profit??
  - kevin_thibedeau 7y ago
    Sell subdomains: nissan.corp.com
    - jowsie 7y ago
      This was actually Mike's intention when he first purchased the domain, he just never got around to it.
- Zenbit_UX 7y ago
  Blackmail and extort executives with the leaked data
  - chx 7y ago
    I am sure Michael "Big Mike" DeSantis and the like would be interested in your proposal...

quickthrower2 7y ago

I love how GoDaddy lets you add the corp.com domain, has a checkout page showing the $1690000.00 and a buy now button. It even has a promo code field, so I wonder if I can get a discount?

michaelsbradley 7y ago
You're funny, but I tried that with a GoDaddy account and I see no such thing. Screenshot?
- cedricium 7y ago
  You can see a similar thing if you search "corp.com" on Namecheap: https://www.namecheap.com/domains/registration/results.aspx?domain=corp.com https://www.namecheap.com/domains/registration/results.aspx?...
  - michaelsbradley 7y ago
    Nice!
  - coolreader18 7y ago
    Name"cheap"
    - organsnyder 7y ago
      At least they wouldn't be charging an exorbitant annual registration fee on top of the purchase price.
  - chx 7y ago
    You can't add it to cart it changes into a chat button if you try.
    - crooked-v 7y ago
      Usually those 'premium'-listed domains are an integration with a third-party service, where high-value domains are handled one-on-one by individual salespeople. There's pretty extensive anti-fraud and anti-money-laundering measures involved to protect the companies involved.

013a 7y ago

I can't believe this situation. This is a guy who, by his own admission, wants it to go to Microsoft, but is also holding an auction. He could just quote Microsoft $2M and be done with this whole thing. Instead, he and this "security firm" publish a big article on one of the internet's most lauded security blogs where they outline how blown away they were with how much data was being sent to this domain. They left it open for 15 minutes and got millions of emails, passwords, etc. "Wow, bad people reading this, look at how much data you could get. You better join in on the auction. Microsoft, you seeing this? You better get in on this too. Bid often and bid well, friends." I wonder what kind of authority ICANN has in revoking domain name registrations in extreme circumstances. Microsoft fucked up here, but we're long past that being a relevant component in this discussion. This registration should be pulled out from under O’Connor and blocked from registration for 100 years.

xvector 7y ago
I am totally OK with the sale of this domain to anyone. He owns the domain and he has the right to sell it. Perhaps the fallout would be good for computer security, as it would stop corporations from making boneheaded security decisions. Pain seems to be the only way to make corporations evolve anyways.
- gumby 7y ago
  I would agree except he is quoted as “fearing” it won’t go to Microsoft. He could just make that happen.
  - newnewpdro 7y ago
    Microsoft has deep enough pockets to make that happen.
  - CydeWeys 7y ago
    But it's very valuable and he wants (needs?) the money for his retirement. Microsoft may not be willing to pay up.

saghm 7y ago

> Schmidt’s findings closely mirror what O’Connor discovered in the few years corp.com was live on the Internet after he initially registered it back in 1994. O’Connor said early versions of a now-defunct Web site building tool called Microsoft FrontPage suggested corporation.com (another domain registered early on by O’Connor) as an example domain in its setup wizard. > That experience, portions of which are still indexed by the indispensable Internet Archive, saw O’Connor briefly redirecting queries for the domain to the Web site of a local adult sex toy shop as a joke. He soon got angry emails from confused people who’d also CC’d Microsoft co-founder Bill Gates. If only Gates had gotten more annoyed back then and bought the domain just to stop the emails...

gpm 7y ago

A domain isn't property that anyone has to respect. I trust my domain resolver to point me at reasonable IP addresses. Not to criminals, people trying to entice criminals, or people trying to extort corporations. I appreciate the fact that the third is likely redundant with the first in most places. I am entirely on board with just killing this domain out from under him.

huffmsa 7y ago
Sure, let's just steal people's property "for the public good". First its domains, then it's farms. Then you're in the breadline.
- gpm 7y ago
  You can't steal property that doesn't exist. A domain isn't property in any standard sense of the word, or at least the properties that makes it valuable aren't. Besides which, what you're talking about is known as "eminent domain" and is already a real thing for real property. Edit: Actually in this case "civil forfeiture" (for the crime of extortion) would probably be a better analogy.
  - huffmsa 7y ago
    So digital "things" aren't real? A lot of people who've been jailed and had to pay big damage money for possessing certain combinations of bits would disagree with you. > Eminent domain Doesn't apply when it's one company that is going to face some consequences.
  - antepodius 7y ago
    A domain name is exclusive use of a region in internet name-space. Land is exclusive use of a region in 2d plane-space on earth. What you can do productively with them is up to you to figure out. Hope you're happy when the government confiscates your patent for that new widget.
    - abofh 7y ago

gist 7y ago

Fwiw the correct way for Microsoft should they decide to bid on this domain to win this auction would be for them to make initial overbids that drive the price up to prevent others simply playing a game of chicken from taking hold and getting sucked into driving the price up even more.

pishpash 7y ago
The correct way is to bid last and not reveal how much they'd be willing to pay.
- gist 7y ago
  Depending on the auction venue may not be a way to 'bid last'.

wolfhumble 7y ago

Just wondering, IANAL, if Microsoft would be afraid of some type of class action lawsuit if buying the domain. Buying it could maybe be seen as taking responsibility for the error earlier committed and could open up a can of worms for Microsoft. In any case, I am sure Microsoft have their reasons for being quiet; it would be an easy problem to solve after all.

heyguys 7y ago

doesnt affect me

zupreme 7y ago

This may be, if as stated in the article, a national-security-level threat. It should be handled as such. Not an auction to the highest (perhaps even foreign) bidder.

RaceWon 7y ago

If it is such a bad risk, why doesn't one of the gazillionairs on here, or even YComb itself just write a check and park it. End of story. I would; but sadly...I haven't hit yet.

kerng 7y ago

These days its .local - we should keep an eye on that

jrumbut 7y ago

Makes me wonder what's happening over at example.com, prod.com, dev.com, ad.com, and whatever other common similar names are out there.

pg_is_a_butt 7y ago
AFAIK example.com is defined as an exception and no one really owns it.
jedberg 7y ago
Luckily example.com is reserved by IANA, so no one can register it.
stevula 7y ago
test.com
- paxswill 7y ago
  In the case of people using .test as a TLD we should be safe(r); .test is a reserved TLD along with .example, .invalid, .localhost and .local (the last being reserved in the long proposed mDNS RFC).

slyall 7y ago

Amazing this sort of thing is still around. I remember there was a similar sort of problem with WPAD (Web Proxy Auto-Discovery) domains like wpad.co.uk and wpad.co.nz that was publicised back in 2007 https://www.networkworld.com/article/2289705/windows-flaw-could-steer-ie-to-hackers.html https://www.networkworld.com/article/2289705/windows-flaw-co...

ganstyles 7y ago

Oh wow, this is fun. Legitimate question: Where can I bid on this? There's no link in the article and a Google search doesn't yield anything but spam.

Mathnerd314 7y ago
From https://www.haven2.com/index.php/domains https://www.haven2.com/index.php/domains it seems the preferred method is email, or maybe looking up his address and sending him snail mail. It's not a formal auction. Also, the EstiBot service he links only appraises corp.com at $112k. The million dollar figure comes from Namecheap/GoDaddy but I don't think Mike will use that as a reference point.

raleighm 7y ago

He's known since 1997 (earlier?) that he has a dangerous domain. He had an offer from Microsoft "several years back" (curious how long ago) but he's holding out for something closer to "market"? I doubt he spent much money purchasing and maintaining the site over the years. Yes, Microsoft should get the purchase done at $1.7m. But O'Connor doesn't exactly come across as a saint here. Pay a "market price" for my sui generis dangerous domain or I'll sell it to the highest bidder...