10 ms·

For those not familiar with the corp.com situation: Corp.com was (is?) the default example domain in many applications from Microsoft. As a result many badly c

by LeonM 7y ago

For those not familiar with the corp.com situation: Corp.com was (is?) the default example domain in many applications from Microsoft. As a result many badly configured networks are attempting to connect to this domain, often sharing credentials in the process. He who owns corp.com will have access to tens of thousands of corporate networks. So the only move that MS had was to buy the domain, regardless of the price. I guess mr O’Connor (who sold the domain) made a nice retirement today.

swyx 7y ago
always wish i could be a fly on the wall for these kinds of negotiations. if O'Connor demanded something ridiculous like 10 billion dollars... how do you talk him down when the situation is this onesided?
- GoodRxEngineer 7y ago
  Typically some sort of horrible "accident" would befall them
- gj667cc 7y ago
  Check out the February article linked in the body of this article about when it went up for sale. It provides a little more context. Sounds like Mr. O'Connor was pretty reasonable about it. https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/ https://krebsonsecurity.com/2020/02/dangerous-domain-corp-co...
  - kevin_thibedeau 7y ago
    This is the relevant part: "O’Connor said Microsoft actually offered to buy the domain several years back for $20,000. He turned them down, saying that at the time he thought it was too low and didn’t reflect the market value of the domain."
    - lonelappde 7y ago
      We need Georgian land value tax for domain names.
      - hombre_fatal 7y ago
        I can't even imagine how an appraisal system would work. How do you even do price discovery? Ask people how much they'd spend on it without actually having to put their money where their mouth is? Land is nothing but objective and quantifiable qualities like its distance from the city, natural resources, size, fertility. Domain names are arbitrary. If people want to swap $millions for vanity, I say let them.
        jedberg 7y ago
        Price discovery is easy. Every domain is available once a year. Anyone can bid. If you want to keep the domain, you pay 1% of the highest bid, otherwise the bidder gets it (they have to put in the money to secure the bid). The only downside is that well capitalized bidders could harass small owners with outsized bids, if they were willing to possibly end up with ownership.
        zeulhex 7y ago
        Agree, but economists do have a solution for this problem. Self-assess the value and pay taxes based on that value. If someone/the government makes an offer that is some percentage greater than that value, you must sell.
        ZainRiz 7y ago
        Sounds like a solution only an econ could think up of, which doesn't take into consideration other external factors that would apply specifically to the person holding the property, such as: - human psychology (loss aversion, endowment effect, mental anxiety due to risk of being forced to sell your property) - switching costs (monetary, mental, time spent searching for alternatives, costs to moving to something else) - replacement costs (transaction costs, etc)
- LeonM 7y ago
  I believe it was not a negotiation, but an auction. So all MS had to do was outbid the highest bid, which would not have been 10 billion.
  - caymanjim 7y ago
    > On Monday evening, he wrote to say that Microsoft had agreed to purchase it. O’Connor said he could not discuss the terms of the deal, nor could he offer further comment beyond acknowledging the sale of corp.com to Microsoft. Not an auction. There's no indication the owner did anything beyond mentioning the desire to auction it.
- jawns 7y ago
  It's not one-sided. There is an incentive on both sides to come to a reasonable agreement. It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. If he could, I could understand why he might be reluctant to sell, even if given a strong offer. But the fact is, if Microsoft walks away from the negotiations, he gets nothing, and there are likely few other buyers he could ethically sell to, and those buyers are unlikely to offer as much as Microsoft can.
  - narag 7y ago
    It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. He could have sold the domain to someone not concerned with the "legally" part.
    - shawnz 7y ago
      But they would be under the same constraints as him. And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. Plus, wouldn't knowingly selling it to a bad actor be a violation of his due diligence?
      - newswasboring 7y ago
        > And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. They can't seize a domain because you were running some service on it, can they?
        angus-prune 7y ago
        They frequently seize domain names used for malware or controlling botnets. Just one example: https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-28-fancy-bear/ https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-...
- swarnie_ 7y ago
  I imagine homeland security can step in at some point if he was being totally unresonable.
- deleted 7y ago
  [deleted]
shawnz 7y ago
This is not the first highly popular domain he's squatted, so I doubt this made a significant impact on his wealth.
jgalentine007 7y ago
It's weird - I don't think I remember ever seeing corp.com as an example from Microsoft - they usually used contoso.com or microsoft.com. I do remember reading books that used corp.com however, but they weren't printed by Microsoft.
- munchbunny 7y ago
  This may be an issue where only networks that have been around for a very long time have this issue due to preserving configurations through many years/cycles of upgrades. Unfortunately, there are many, many such networks.
- dewey 7y ago
  There seems to be a bunch of references if you look for it on their site: "corp.com" site:microsoft.com Example: https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp/nf-wsmandisp-iwsman-createsession https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp...
  - lonelappde 7y ago
    That nuts. MS has known about this bug for 20 years! Example.com exists for a reason. How could anyone trust MS for security anything?
    - diamondo25 7y ago
      How about people "stackoverflowing" solutions? Yea, blame the examples, not the implementers...
caymanjim 7y ago
> I guess mr O’Connor (who sold the domain) made a nice retirement today. The original article said he was trying to auction it starting at $1.7M. There's no indication that an auction ever took place, however. It also sounds like the owner wanted Microsoft to buy it and was willing to work with them, and ultimately this is what happened. My guess is that it went for well under $1.7M.
- andybak 7y ago
  Although that's peanuts to MS - they've probably spent multiples of that over the years to plug the holes this creates. I'd personally be happy to hear Mr O'Connor got a windfall in this case.
  - chipperyman573 7y ago
    I was listening to a podcast about this, apparently he registered a ton of domains (including Corp.com) for free a long time ago and has been squatting and slowly selling them back at extortion prices. He's done this many times before and already retired because of these payouts. I'm not happy to hear he got a single cent
    - arcticbull 7y ago
      Eh, he identified something of value early on before anyone else did. This is literally how the stock market works. Let's re-phrase: "Ugh, I can't believe he made money by acquiring a large pile of Apple stock for $1 each back in the 90's, squatting on it, then slowly selling it at extortionate (read: market) prices a few decades later. He's done this many times before and already retired because of these payouts. I'm not happy to hear he got a single cent."
      - chipperyman573 7y ago
        I don't really see how this is related to stocks. First, he got these all for free, while you have to buy stocks. There's a risk that they might be worthless down the line and you lose all the money you spent Second, when you invest you are offering financial value. He just contacted someone, said "hey can I have these domains please?" and did nothing with them for 25+ years, until he was finally able to demand a payout. again. are all the people who tried to sell their hoarded toilet paper people who "identified something of value early on before anyone else did"?
PhasmaFelis 7y ago
> Corp.com was (is?) the default example domain in many applications from Microsoft. This seems like Microsoft in a nutshell, when example.com has been the official standard example since at least 1999.
- fortran77 7y ago
  This is not the problem. > Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”
fortran77 7y ago
This is not an accurate explanation of the problem. > Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled. While it's true that access used "corp.com" as a sample domain, the problem is what Krebs calls "domain DNS devolution" > Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.” Krebs has written two articles about this that explain the problem.
solarkraft 7y ago
Ok, naive question: Why the <expletive> did they do that in the first place?
- mirimir 7y ago
  I think that it was basically that Microsoft was very slow to adapt to the existence of the Internet.
Causality1 7y ago
The shortsightedness of not making the default domain something Microsoft already owned is, to put it mildly, breathtaking.
andrewaylett 7y ago
It's more that `CORP` was the default short name for the AD domain, and also Windows ticks the "try superdomains" box in search domains by default. So if you have your fully-qualified AD domain set to `ad.example.com`, that's the default search domain too, and a DNS lookup for `corp` will first check `corp.ad.example.com` then `corp.example.com` then `corp.com`. Now, if you're using the AD server as your DNS server then it shouldn't get that far -- `corp.ad.example.com` should resolve. But if for whatever reason a device connected to AD doesn't use the AD server as its DNS server, for example if it's a laptop and not connected to the corporate network, then you'll be offered a _different_ search domain like `myisp.com`. Which probably _won't_ resolve `corp.myisp.com`. So the built-in resolver will after all walk its way up the search domain and check `corp.com` QED.

by LeonM 7y ago

swyx 7y ago

always wish i could be a fly on the wall for these kinds of negotiations. if O'Connor demanded something ridiculous like 10 billion dollars... how do you talk him down when the situation is this onesided?

GoodRxEngineer 7y ago
Typically some sort of horrible "accident" would befall them
gj667cc 7y ago
Check out the February article linked in the body of this article about when it went up for sale. It provides a little more context. Sounds like Mr. O'Connor was pretty reasonable about it. https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/ https://krebsonsecurity.com/2020/02/dangerous-domain-corp-co...
- kevin_thibedeau 7y ago
  This is the relevant part: "O’Connor said Microsoft actually offered to buy the domain several years back for $20,000. He turned them down, saying that at the time he thought it was too low and didn’t reflect the market value of the domain."
  - lonelappde 7y ago
    We need Georgian land value tax for domain names.
    - hombre_fatal 7y ago
      I can't even imagine how an appraisal system would work. How do you even do price discovery? Ask people how much they'd spend on it without actually having to put their money where their mouth is? Land is nothing but objective and quantifiable qualities like its distance from the city, natural resources, size, fertility. Domain names are arbitrary. If people want to swap $millions for vanity, I say let them.
      - jedberg 7y ago
        Price discovery is easy. Every domain is available once a year. Anyone can bid. If you want to keep the domain, you pay 1% of the highest bid, otherwise the bidder gets it (they have to put in the money to secure the bid). The only downside is that well capitalized bidders could harass small owners with outsized bids, if they were willing to possibly end up with ownership.
      - zeulhex 7y ago
        Agree, but economists do have a solution for this problem. Self-assess the value and pay taxes based on that value. If someone/the government makes an offer that is some percentage greater than that value, you must sell.
        ZainRiz 7y ago
        Sounds like a solution only an econ could think up of, which doesn't take into consideration other external factors that would apply specifically to the person holding the property, such as: - human psychology (loss aversion, endowment effect, mental anxiety due to risk of being forced to sell your property) - switching costs (monetary, mental, time spent searching for alternatives, costs to moving to something else) - replacement costs (transaction costs, etc)
LeonM 7y ago
I believe it was not a negotiation, but an auction. So all MS had to do was outbid the highest bid, which would not have been 10 billion.
- caymanjim 7y ago
  > On Monday evening, he wrote to say that Microsoft had agreed to purchase it. O’Connor said he could not discuss the terms of the deal, nor could he offer further comment beyond acknowledging the sale of corp.com to Microsoft. Not an auction. There's no indication the owner did anything beyond mentioning the desire to auction it.
jawns 7y ago
It's not one-sided. There is an incentive on both sides to come to a reasonable agreement. It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. If he could, I could understand why he might be reluctant to sell, even if given a strong offer. But the fact is, if Microsoft walks away from the negotiations, he gets nothing, and there are likely few other buyers he could ethically sell to, and those buyers are unlikely to offer as much as Microsoft can.
- narag 7y ago
  It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. He could have sold the domain to someone not concerned with the "legally" part.
  - shawnz 7y ago
    But they would be under the same constraints as him. And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. Plus, wouldn't knowingly selling it to a bad actor be a violation of his due diligence?
    - newswasboring 7y ago
      > And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. They can't seize a domain because you were running some service on it, can they?
      - angus-prune 7y ago
        They frequently seize domain names used for malware or controlling botnets. Just one example: https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-28-fancy-bear/ https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-...
swarnie_ 7y ago
I imagine homeland security can step in at some point if he was being totally unresonable.
deleted 7y ago
[deleted]

shawnz 7y ago

This is not the first highly popular domain he's squatted, so I doubt this made a significant impact on his wealth.

jgalentine007 7y ago

It's weird - I don't think I remember ever seeing corp.com as an example from Microsoft - they usually used contoso.com or microsoft.com. I do remember reading books that used corp.com however, but they weren't printed by Microsoft.

munchbunny 7y ago
This may be an issue where only networks that have been around for a very long time have this issue due to preserving configurations through many years/cycles of upgrades. Unfortunately, there are many, many such networks.
dewey 7y ago
There seems to be a bunch of references if you look for it on their site: "corp.com" site:microsoft.com Example: https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp/nf-wsmandisp-iwsman-createsession https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp...
- lonelappde 7y ago
  That nuts. MS has known about this bug for 20 years! Example.com exists for a reason. How could anyone trust MS for security anything?
  - diamondo25 7y ago
    How about people "stackoverflowing" solutions? Yea, blame the examples, not the implementers...

caymanjim 7y ago

> I guess mr O’Connor (who sold the domain) made a nice retirement today. The original article said he was trying to auction it starting at $1.7M. There's no indication that an auction ever took place, however. It also sounds like the owner wanted Microsoft to buy it and was willing to work with them, and ultimately this is what happened. My guess is that it went for well under $1.7M.

andybak 7y ago
Although that's peanuts to MS - they've probably spent multiples of that over the years to plug the holes this creates. I'd personally be happy to hear Mr O'Connor got a windfall in this case.
- chipperyman573 7y ago
  I was listening to a podcast about this, apparently he registered a ton of domains (including Corp.com) for free a long time ago and has been squatting and slowly selling them back at extortion prices. He's done this many times before and already retired because of these payouts. I'm not happy to hear he got a single cent
  - arcticbull 7y ago
    Eh, he identified something of value early on before anyone else did. This is literally how the stock market works. Let's re-phrase: "Ugh, I can't believe he made money by acquiring a large pile of Apple stock for $1 each back in the 90's, squatting on it, then slowly selling it at extortionate (read: market) prices a few decades later. He's done this many times before and already retired because of these payouts. I'm not happy to hear he got a single cent."
    - chipperyman573 7y ago
      I don't really see how this is related to stocks. First, he got these all for free, while you have to buy stocks. There's a risk that they might be worthless down the line and you lose all the money you spent Second, when you invest you are offering financial value. He just contacted someone, said "hey can I have these domains please?" and did nothing with them for 25+ years, until he was finally able to demand a payout. again. are all the people who tried to sell their hoarded toilet paper people who "identified something of value early on before anyone else did"?

PhasmaFelis 7y ago

> Corp.com was (is?) the default example domain in many applications from Microsoft. This seems like Microsoft in a nutshell, when example.com has been the official standard example since at least 1999.

fortran77 7y ago
This is not the problem. > Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”

fortran77 7y ago

This is not an accurate explanation of the problem. > Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled. While it's true that access used "corp.com" as a sample domain, the problem is what Krebs calls "domain DNS devolution" > Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.” Krebs has written two articles about this that explain the problem.

solarkraft 7y ago

Ok, naive question: Why the <expletive> did they do that in the first place?

mirimir 7y ago
I think that it was basically that Microsoft was very slow to adapt to the existence of the Internet.

Causality1 7y ago

The shortsightedness of not making the default domain something Microsoft already owned is, to put it mildly, breathtaking.

andrewaylett 7y ago

It's more that `CORP` was the default short name for the AD domain, and also Windows ticks the "try superdomains" box in search domains by default. So if you have your fully-qualified AD domain set to `ad.example.com`, that's the default search domain too, and a DNS lookup for `corp` will first check `corp.ad.example.com` then `corp.example.com` then `corp.com`. Now, if you're using the AD server as your DNS server then it shouldn't get that far -- `corp.ad.example.com` should resolve. But if for whatever reason a device connected to AD doesn't use the AD server as its DNS server, for example if it's a laptop and not connected to the corporate network, then you'll be offered a _different_ search domain like `myisp.com`. Which probably _won't_ resolve `corp.myisp.com`. So the built-in resolver will after all walk its way up the search domain and check `corp.com` QED.