17 ms·
Microsoft buys corp.com so bad guys can’t
- kryogen1c 7y agothe problem is DNS, as one would guess: >the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled. whew boy. whats the right answer here? out of the box AD and DNS coming with default settings that must be changed prior to use?
- astrea 7y agoI feel as though we hear about some horrible security flaw from Microsoft every other day.
- wwn_se 7y agoThey are very transparent about security. Very few companies are on their level of security maturity maybe a handful.
- nkozyra 7y agoIs this really a security flaw from Microsoft, necessarily, or just a convention adopted that leads to a lot of accidental misdirection of traffic? Don't get me wrong, making users be explicit is ideal, but this doesn't feel like it belongs in the same boat.
- MichaelApproved 7y agoIt's definitely a security flaw created by Microsoft. A default/pre-filled value should be an acceptable value to use. By prepopulating "Corp", they implied that it was an acceptable value their customers could use. What else would you think a prepopulated value would mean? Fixing a flaw this big for what we assume is under $2 million seems like a bargain.
- jaclaz 7y agoI don't know. Meaning that in this case the MS customers are not "end customers", they are highly specialized (in theory) and highly paid (in practice) IT specialists setting up (part of) a complex (and security sensible) corporate network backbone such as Active Directory.
- jedieaston 7y agoExcept that this was also the default in SBS, a product specifically designed for a small business with little to no IT staff. (Why a small business that didn't have IT staff would bother with AD I do not know, but I believe the package also included an email server?)
- jaclaz 7y agoYep, but come on, any small business owner won't even know what AD is or why it should be used, and they would be convinced to use it by an external consultant (as well in theory belonging to the highly spoecialised and highly paid IT people). This leaves us with only a part of small businesses (the ones where the owner let his daughter's son, or his cousin, which is "good at computers" manage their network).
- holtalanm 7y agobut they didn't pre-populate it. they used 'corp' within their instruction text as a placeholder for whatever the corporation wanted to use. from my understanding, nothing was pre-populated.
- kps 7y agoI'll give them a break if the text predates RFC2606 (1999) and the product hasn't been touched since. > Confusion and conflict can be caused by the use of a current or future top level domain name in experimentation or testing, as an example in documentation, to indicate invalid names, or as a synonym for the loop back address. Test and experimental software can escape and end up being run against the global operational DNS. Even examples used "only" in documentation can end up being coded and released or cause conflicts due to later real use and the possible acquisition of intellectual property rights in such "example" names. (emphasis added)
- jabroni_salad 7y agoCurrently when putting in a new AD the name field is just blank and you have to put something in to continue. There is no default setting.
- W4ldi 7y agomost linux server distributions come without a firewall installed/activated. does this default mean it's linux' fault when users do not setup a firewall?
- ed312 7y agoAt least a little? That's extremely hostile behavior to new users. I could see not shipping a lot of these things for a highly optimized server version etc. For a standard end user (and let's be honest, middle/large company IT dept guy), you should put some sane defaults in place.
- crankylinuxuser 7y agoAnother part about the firewall is that without profiling, it's pretty hard to make a good firewall that allows "good traffic" and denies the "bad". It takes a good amount of profiling and being a firewall admin. And for a house, thats kind of overkill for the general network. Sure, set up a restricted wifi for IoT crap, but having to fiddle with it daily is NOT acceptable.
- cesarb 7y agoWell, it's hard for a Linux server distribution to not come with a firewall installed, since it's part of the kernel; all Linux distributions I've seen (including tiny floppy-disk-based Linux distributions) come with the firewall module enabled in the kernel configuration. As for being activated: my recent experience with is mostly with RedHat-derived Linux server distributions (like CentOS), and they do come with the firewall enabled (which more than once made things not work until we noticed it was the firewall again). That didn't use to be the case in the distant past, however.
- mercora 7y agothats is one of the reasons i think its not smart to automatically start some services per default after package install on Debian. I guess its justified by having sane default service configurations but its still a bad idea in my opinion.
- pantalaimon 7y agoThere might be a reason why example.org was chosen for documentation purpose.
- tialaramex 7y agoThe example TLD is also reserved, for when your example needs a TLD rather than a 2LD or some other domain. This allows you to make up a bunch of 2LDs in documentation e.g. https://cat-food.example/ https://cat-food.example/ https://dog-food.example/ https://dog-food.example/ and https://pet-food.example/ https://pet-food.example/ might be three different companies that sell pet foods, or they might all be brands of the same company, whereas if I used names like https://cat-food.example.org/ https://cat-food.example.org/ and https://dog-food.example.org/ https://dog-food.example.org/ that's confusing because we'd say it's very unlikely for rival companies to share a 2LD this way.
- andrewaylett 7y agoIt's perfectly possible that many of the AD domains affected pre-date ubiquitous laptops, and desktops don't tend to roam so are unlikely to meet a differently-configured search domain.
- 6d6b73 7y agoIn other words - Bad guys buy corp.com so other bad guys can't .
- deleted 7y ago[deleted]
- philliphaydon 7y agoI'm confused, article said Microsoft bought it. Not google.
- Blaiz0r 7y agoYou must not remember much about Microsoft in the 80/90s
- gambiting 7y ago80s were literally 40 years ago at this point. How many of the original employees are even at Microsoft at this point? At which point complaining about Microsoft's actions decades ago will be the same as complaining about Bayer making chemicals for the Nazis - as in, relevant historically, but not very relevant at the present?
- ilikehurdles 7y agoI think this entire thread is a waste of space and deserves its negative votes, but Microsoft of today is no better than google. They both sell spyware disguised as OSes and consumer devices.
- gambiting 7y agoOf course, and they can get all the hate they can for this. But for the stuff they did 40 years ago? Somehow I feel like that's water under the bridge at this point.
- scalableUnicon 7y agoMy D-Link router had domain.name as the default dhcp domain name, which caused some of my devices connected to it to resolve <whatever.tld>.domain.name when <whatever.tld> fails to resolve and someone have set up ad pages in many .domain.name pages to take advantage of the flaw. I've recently blogged about it(https://harigovind.org/articles/who-is-hijacking-my-nxdomains/ https://harigovind.org/articles/who-is-hijacking-my-nxdomain...). Need to be always careful when configuring things like this especially since we now have hundreds of tlds like .email, .work etc.
- myself248 7y agoI feel like there should be fines for using anything other than reserved-by-RFC names. When will it end?
- MichaelApproved 7y agoSupposedly, the free market should correct this when consumers stop buying the flawed product. Companies will recognize that poor security is not profitable and make improvements. In reality, consumers aren't (and can't) be educated enough to avoid products with these types of flaws. So, it's up to government to regulate but consumers (citizens) still need to care enough to ask the government to regulate with fines and recalls. EU citizens seem to have that type of government but US citizens would still rather protect corporate bad actors than protect themselves. If we see any kind of legislative pressure, my bet is it'll be from the EU well before the US.
- mgkimsal 7y agohow do I deal with this as a consumer when... I go buy a router from target... bring it home. 4 months later there's a security upgrade which also changes the DNS resolution behavior to give me ads. What's my recourse as a consumer in this case? return to target? return to dlink or whoever manufactured it?
- dahfizz 7y ago> Supposedly, the free market should correct this when consumers stop buying the flawed product. Any free market purist will tell you that all transactions must be both mutually consenting and informed. If these conditions are not met, it is the governments job to step in.
- macintux 7y agoSeems like it’d be a consulting opportunity. Watch the traffic, identify companies that need help reconfiguring their domain, and contact them. Although I suppose to the recipient of such an email it might sound like an extortion racket.
- deleted 7y ago[deleted]
- captncraig 7y ago"Yeah, we know it is wrong, but that single decision made 10+ years ago is too hard to change now without unknown side effects. Microsoft owns it now, so nothing too bad will happen"
- LeonM 7y agoFor those not familiar with the corp.com situation: Corp.com was (is?) the default example domain in many applications from Microsoft. As a result many badly configured networks are attempting to connect to this domain, often sharing credentials in the process. He who owns corp.com will have access to tens of thousands of corporate networks. So the only move that MS had was to buy the domain, regardless of the price. I guess mr O’Connor (who sold the domain) made a nice retirement today.
- swyx 7y agoalways wish i could be a fly on the wall for these kinds of negotiations. if O'Connor demanded something ridiculous like 10 billion dollars... how do you talk him down when the situation is this onesided?
- GoodRxEngineer 7y agoTypically some sort of horrible "accident" would befall them
- gj667cc 7y agoCheck out the February article linked in the body of this article about when it went up for sale. It provides a little more context. Sounds like Mr. O'Connor was pretty reasonable about it. https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/ https://krebsonsecurity.com/2020/02/dangerous-domain-corp-co...
- kevin_thibedeau 7y agoThis is the relevant part: "O’Connor said Microsoft actually offered to buy the domain several years back for $20,000. He turned them down, saying that at the time he thought it was too low and didn’t reflect the market value of the domain."
- lonelappde 7y agoWe need Georgian land value tax for domain names.
- nomanlagharipak 7y agoi am good poet i have publish to many books but now i am getting start website you can check on below link https://www.yoururdupoetry.com/2020/04/best-love-poetry-in-urdu-and-hindi.html https://www.yoururdupoetry.com/2020/04/best-love-poetry-in-u...
- KindOne 7y agoPrevious discussion: https://news.ycombinator.com/item?id=22277185 https://news.ycombinator.com/item?id=22277185 "Dangerous domain corp.com goes up for sale" - Feb 9, 2020.
- dancemethis 7y agoThat's an Onion title right there.
- Eliezer 7y agoI unironically salute Microsoft for cleaning up the mess they created. Many large actors don't. There was one right thing to do at this point and they did it.
- thefox 7y agoBut why did Microsoft use a domain in its products which they do not own?
- myself248 7y agoRTFOA. They didn't. They used an internal ActiveDirectory domain of "Corp" as an example. An AD domain is not the same as a domain name. ....until it comes time for the Windows name service to try to idiotproof the user, and say "well, this doesn't resolve to an AD server here, maybe they meant it as a domain name, let me try appending .com and attempt a DNS query" It's a case of the right hand not knowing the left hand's usability tweak would turn into a security issue. Unquestionably Microsoft's fault, but it wasn't as simple as you make it out to be.
- hackmiester 7y agoDoes the Windows DNS client actually behave this way though? I have never seen it adding com, or any other tld.
- andrewaylett 7y ago"Let me try with the search domain. No, doesn't exist. Let's knock the first element off the search domain and try again until we find it. What do you mean you connected your laptop to a network that's not your work network so the AD server isn't accessible?"
- drewzero1 7y agoRight? Why not just use microsoft.com, since they already owned that and presumably will for at least as long as the products' lifetimes. If you're going to use a default value at least use one you can control.
- gfiorav 7y agoThis is why I use foo TLDs in the documentation. To make sure it won't work in a copy-paste situation.
- 013a 7y agoexample.com is also always a safe one; RFC-2606 defines four top-level domains and three second-level domain names permanently reserved by IANA for testing purposes: .test, .example, .invalid, .localhost, .example.com, .example.net, and .example.org.
- pix64 7y agoFYI, google owns .foo
- gfiorav 7y agoha, the more you know!
- caymanjim 7y ago> This is why I use foo TLDs in the documentation. To make sure it won't work in a copy-paste situation You're describing the exact methodology that led to this problem.
- athenot 7y agoThis is a reminder to all of us to use example.com[1] for these types of defaults, examples, illustrations. And also to scan code bases & configs on a regular basis for the inevitable "dummy yet resolvable" addresses that sneak back in out of bad habit. [1]https://tools.ietf.org/html/rfc6761 https://tools.ietf.org/html/rfc6761
- xiaodai 7y agoAnd the good guys are?
- pradn 7y agoThis could be a case for "eminent domain"ing the domain from this user. If domains are property, "eminent domain" must apply to them too.
- 2sk21 7y agoYears ago, one of my coworkers bought testcompany.com and got an amazing amount of internal emails from organizations.
- andy_ppp 7y agoTo be fair if I was Microsoft I’d probably just do a Windows update that adds 127.0.0.1 corp.com to wherever they keep the hosts file on windows :-)
- chills 7y agoDo you really think these organizations shipping their credentials off to corp.com are applying Windows updates?
- andy_ppp 7y agoIn which case they aren't worried about security, so why does buying corp.com matter?
- stordoff 7y agoDepends if it's an update people/organisations would apply: > Over the years, Microsoft has shipped several software updates to help decrease the likelihood of namespace collisions that could create a security problem for companies that still rely on Active Directory domains that do not map to a domain they control. > However, experts say hardly any vulnerable organizations have deployed these fixes for two reasons. First, doing so requires the organization to take down its entire Active Directory network simultaneously for some period of time. > Second, according to Microsoft applying the patch(es) will likely break or at least slow down a number of applications that the affected organization relies upon for day-to-day operations. Faced with either or both of these scenarios, most affected companies probably decided the actual risk of not applying these updates was comparatively low.
- ChrisArchitect 7y agodid MS buy the domain from the guy for $1.7 million?
- alberth 7y agoI've always wonder how large SaaS companies (e.g. Salesforce, Workday, etc) ensure they don't let their domain mistakenly expire. It'd be devastating to their business if someone were to purchase the expired domain of say, salesforce.com (e.g. customers wouldn't be able to log into their paid for SaaS service, potentially corp email would be down, etc).
- Shank 7y agoMany companies outsource domain registration to Mark Monitor or equivalent services, and Mark Monitor independently handles registration so that this doesn't happen. The larger the company, the higher the chance this is someone's job role or some company's service -- it's definitely on everyone's radar (at least today, MS has had a bad history in this department).
- spelunker 7y agolots and lots of alarms, I imagine. Also plenty of DNS registrars will let domains enter a grace period where the original owner can re-register the domain before it's released back to the public. Obviously being able to renew through an automated process is the best solution (LetsEncrypt, etc)
- kseifried 7y agoWe discussed this on the OpenSourceSecurity Podcast back in Feb 2020 https://www.opensourcesecuritypodcast.com/2020/02/episode-184-its-dns-its-always-dns.html https://www.opensourcesecuritypodcast.com/2020/02/episode-18... TL;DR: this is the least painful outcome of these DNS shenanigans.
- deleted 7y ago[deleted]
- patall 7y agoWasn't this one of the reasons why some organizations lobbied against the extension on tld names? For example, in Germany we have lots of Fritz!box routers that are managed via 'fritz.box' which is now also a valid URL.
- chatman 7y agoMicrosoft is the "bad guy".
- _emacsomancer_ 7y ago"Microsoft buys corp.com so the other bad guys can’t"
- MaysonL 7y agoI wonder if this is by any chance the same Michael O'Connor who wrote the Mac application CompuServe Navigator back in the '90s?
- shayanbahal 7y agoThis reminded me of `WPAD` namespace for DNS and DHCP: https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Proto... I remember logging all requests to wpad.ir, there were many from Brazil for some reason.
- diebeforei485 7y agoSomewhat related: A lot of random networking hardware seems to use "1.1.1.1" I have even had Wi-Fi networks ask me to go to 1.1.1.1 to load their payment page so I can pay for the internet service.