3 ms·
> John Berryhill provided some forensic work in Twitter that showed the compromise actually happened in September. The domain was transferred to the BizCN regis
by hnarn 6y ago
> John Berryhill provided some forensic work in Twitter that showed the compromise actually happened in September. The domain was transferred to the BizCN registrar in December, but the nameservers were not changed.
Isn't this preventable with "clientTransferProhibited"[1]?
> This status indicates that it is not possible to transfer the domain name registration, which will help prevent unauthorized transfers resulting from hijacking and/or fraud. If you do want to transfer your domain, you must first contact your registrar and request that they remove this status code.
If nothing else, you'd think that some simple monitoring would be warranted if you own an important domain, like checking the exit code of:
# whois -h whois.verisign-grs.com google.com | grep "Registrar: MarkMonitor, Inc."
[1]: https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en#clientTransferProhibited https://www.icann.org/resources/pages/epp-status-codes-2014-...
- bhartzer 6y agoIf the domain thief has access to the network solutions account, they can just remove the domain lock. They have the keys to everything. There are more secure registrars than network solutions that require much more to transfer, like others have executive lock. You can specify certain terms that must be done before a change. Like the registrar must call you on a certain phone number and get a password verbally. At DnProtect, we are aware of at least 20 domains that have been stolen since the beginning of the year. Most from network solutions.
- 35fbe7d3d5b9 6y agoI don't understand the expected outcome from this attack. The hijacking of perl.com was front page news for the technical community. Did the thief really think they'd just be able to drop it on Sedo or Afternic and be done with it?
- edoceo 6y agoRansom maybe?
- bhartzer 6y agoNah, ransom is not usually the goal by domain thieves. They steal them to make a quick buck by reselling them.
- bhartzer 6y agoI don’t think it’s really an attack on the domain Perl.com. Rather, Perl was just one of the domains stolen at the same time as others. I’m aware of at least half a dozen or so domains that were stolen at the same time, by the same domain thief. This was not an attack or hijacking. It was the stealing of domain names. What these domain thieves do is steal the domain, transfer it to another registrar, then attempt to sell them. In this case, Perl.com just got caught up in a list of domains that were stolen at the same time. Others stolen at the same time also start with the letter P.