9 ms·
How I hijacked the top-level domain of a sovereign state
- als0 6y agoThe TL;DR: he registered one of the expired domains that manage the TLD namespace of Democratic Republic of Congo.
- xwdv 6y agoIt pisses me off that for something of this magnitude this guy will probably only be paid no more than a couple thousand dollars, if at all. He still has no response.
- gumby 6y agoThis was good work. The DRC has a lot of problems (to say the least) at the moment and has had for a while and this is pretty low priority in their scheme of things. Countries with weird residual TLDs for non-sovereign territory (e.g. .as or .ac) surely pay more attention to these trivial domains than anyone in the DRC can. Which is all to say the amount of effort expended on any task, or the amount of knowledge brought to bear on a task, is only sometimes correlated with its value. Ever worked hard on a company that failed? I felt I needed to put the first line in because my comment on your question could have been misinterpreted as criticism of the hacker.
- u678u 6y agoDR Congo is one of the poorest countries in the world. GDP/cap is $457 a year. If he does get a few thousand that is more than one worker earns in 10 years. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nominal)_per_capita https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...
- avh02 6y agoUnderstandable stance, but the damage he was capable of causing was probably millions of dollars worth. So yeah, a few thousand bucks as a thank you is reasonable.
- lostlogin 6y ago> the damage he was capable of causing was probably millions of dollars That applies to most of us. It also doesn’t change the fact that there is very little money available in the DRC.
- xwdv 6y agoWhat on earth does that have to do with anything here? I probably make more as a software developer than some Americans make in 10 years.
- nerdponx 6y agoIf rich countries and private charities were serious about foreign aid, they'd consider helping fund things like this.
- lostlogin 6y agoPaying developers outside the DRC? I’d imagine that most who wanted to help would prefer something more direct.
- toshk 6y agoI work for a few a cities in Europe, and happen to know one of the cities had a site with an sql injection issue. An external person found and let the city know but didn't want to reveal the specifics before getting money. The city has no bounty program and for some people in the City it came across as if the guy was distorting them. The guy probably felt like he didn't get money for his work. Probably both have a point. In the end it got resolved.
- lovasoa 6y agoThe guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.
- LegitShady 6y agoWhat are their damages? He's not required to disclose their security vulnerabilities to them. It's his work not theirs.
- high_density 6y agoI think lovasoa is pointing out what could happen in real-life, not 'what should happen morally/ethically/etc'.
- murphy1312 6y agoif he was smart, then he said nothing that sounds like blackmail. but you could say, for example, that I have to settle the expense of reproducing it and writing it down properly or something similar.
- Chris2048 6y agosue him for what? Discovering an exploit without disclosing the details?
- lovasoa 6y agoIt depends on the country, but in France for instance, there is a maximum sentence of one year in prison and a 15000€ fine just for "fraudulently accessing a data processing system", or trying to do so even if you don't succeed.
- prosaic-hacker 6y agoIt may not directly pay but his reputation as Security Expert is enhanced. I don't know if "Big Internet" (ICANN, IANA, IETF, RIRs) does not have its own security group like the Commercial companies do (Project Zero, various EH companies). RFC3013??? We have to depend on people who can take time to look for exploits in exchange for reputation.
- LegitShady 6y agoGetting paid in exposure is not getting paid.
- pedro596 6y agoIt seems more likely that the OP even lost money buying a useless domain name that no one will pay for. Most probably not even a "Thank You" they will give.
- psim1 6y agoWhy should he get anything at all? Does every "ethical hacker" need to hold his hand out for a reward? (Doesn't seem as ethical, then, does it?)
- 0x0 6y agoCould this be leveraged to hijack additional TLDs? If any other TLD uses a ".cd" NS, like .cd used a ".com" NS...? (Are there any?)
- jaywalk 6y agoYes, although it's hard to imagine any TLD using .cd for NS. It would also be less effective unless that TLD was using .cd for ALL of it's NS records.
- 0x0 6y agoMaybe you could find a cluster of TLDs delegating to each other in a loop. Combined with huge TTLs you might be able to bootstrap a full takeover of a subset of all DNS?
- fjiizrsdfjjj 6y agoShouldn't he have acted when he noticed the soonish expiration instead of hoping to be the only one watching for expiration?
- yaveti 6y agoIt's not uncommon for organisations to be late with renewing their domains and you probably don't want to send false alarms.
- CydeWeys 6y agoOnce it's in the redemption grace period the domain is already on the way to deletion. That's not part of the normal domain lifecycle; that's part of the deletion lifecycle. This was not a false alarm.
- random5634 6y agoYou clearly have never ever worked in domain renewals before. Many people only renew once dns stops resolving. I've seen govt agencies use this as their reminder to renew. And yes, many scammers out there send postcards to businesses offering to assist for $1,000 on the renewals - and many people pay. So people do send out "alerts" the way you ask - most commonly exploitive and at least I give the advice to ignore ALL such renewal alerts. If you are telling people to respond to those you are sending people down scam ally.
- CydeWeys 6y ago> Many people only renew once dns stops resolving. DNS stops resolving because the domain is pending deletion. At that point it's not a renewal, it's a restore (which costs a lot more money). Refer to the brown "Domain no longer in zone" section of ICANN's lifecycle chart: http://archive.icann.org/en/registrars/gtld-lifecycle.jpg http://archive.icann.org/en/registrars/gtld-lifecycle.jpg If people are actually regularly using restores instead of renews then they're unnecessarily throwing away lots of money. > I've seen govt agencies use this as their reminder to renew. What TLDs were these government agencies using? gTLDs have uniform policies but ccTLDs and special purpose TLDs like .gov do not (and you cannot generalize your experience there to gTLDs). But the expired nameserver domain registration under discussion in this article is a .com, which is a gTLD, so it goes through the standard lifecycle of 30 day redemption grace period + 5 day pending delete period, and during these its DNS is yanked. Source: I've been in the domains industry for 7 years and run 44 TLDs.
- sdfhbdf 6y agoInteresting read and also the reaction from authorities in DRC is interesting - they changed the records with IANA. Probably good course of action because OP could hold them hostage and they shouldn't risk relying on his written confirmation in such a important matter. Good decision making on the DRC in the end. Well Done.
- saadalem 6y agoMany times, you scan an IP, look at the easy hackable websites that may be on the same IP, you upload the shell and try to go all-in and take over all the websites in same IP, ez and I dont't know why we still face these problems that are outdated !
- dougk 6y agoI had a gut feeling it will be '.cd' before clicking on the article and I was right. Dealing with the state entity (SCPT) that manages this TLD is quite a pain. It's so painful that I've given up managing all the .cd domains I used to own. .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.
- dewey 6y ago> .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously. I bought one a few years ago for 80 Euros / year. Aren't there a lot of TLDs that are way more expensive?
- KMnO4 6y agoNot too many ccTLDs. AI comes to mind (Anguilla, expensive for obvious reasons), but it’s still cheaper than .CD. Many gTLDs are expensive due to their target demographics or to dissuade bad actors (eg .auto, .bank).
- 4ec0755f5522 6y agoThe new crop of TLDs are really cheap. I bought a .download for like $2 a year or something. Not all are that cheap (I bought it as a throwaway for a project that relied on my having DNS control) but there are literally hundreds of them that are.
- kadoban 6y agoOnly issue is I don't think there's anything preventing the price going sky-high in coming years, for most of these TLDs. For a throwaway it doesn't matter, but could really hurt if you start relying on one.
- kweks 6y agoKiribati (.ki) comes to mind - 900€ per year via ghandi.net or 1350€ at eurodns...
- ricardo81 6y agoOf course, the moral of the story goes beyond TLDs and for nameserver hostnames in general. Interesting that it wasn't drop-catched, as .com names tend to be. I suppose it didn't have any metrics that'd qualify it for automatic registration. Not even for 'domain tasting', though I guess it depends on drop catchers setups, which I imagine is just interested in any traffic on port 80/443.
- rvnx 6y agoThe most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).
- sb057 6y agoQuoting the article: >On January 7th, I reached out to the Administrative and Technical contacts listed for .cd on [https://www.iana.org/domains/root/db/cd.html https://www.iana.org/domains/root/db/cd.html].
- electricmonk 6y agoA week after he registered the domain name. That's not the same thing as "before," which I believe the top comment in this thread was implying about what he should have done instead of what he did do.
- tailspin2019 6y agoYes I spotted that “week” too. Seems odd to wait a week to make contact if this was purely a white-hat exercise.
- cmehdy 6y agoI assume you mean that he should have done that when he noticed the domain was pending renewal? (edited to "renewal", not deletion) He definitely acted decently overall (and did reach out to the people you mention afterwards). But I can empathize with the author for simply thinking "pending renewal? alright whatever" and later on "pending DELETE? shit I should make sure they're OK!". I guess there's always what's best in hindsight and what's actually done.
- deleted 6y ago[deleted]
- 6y ago
- justinclift 6y ago> Although one of the contacts replied and delegated to their colleague, as of this writing, I haven’t received any follow-up confirmation that they fixed the issue. Wonder if that means they're investigating a "legal response" to his report? eg the old "shoot the messenger" approach :/
- cesarb 6y ago> If I had operated with malicious intent, I could have also [...] Wouldn't most of these be mitigated if that ccTLD used DNSSEC (according to dnsviz, it currently doesn't)? The hijacked DNS servers wouldn't be able to provide correctly-signed DNS records, so the fake answers would be rejected by all validating resolvers.
- SoSoRoCoCo 6y agoWow. An entire country can accidentally be hosed if their domain name used by their NS expires? Is it that perilous?