3 ms·

I've read through this article several times, and I am failing to see how this could possibly be used to form an attack. Sure - taking the provider down is bad

I've read through this article several times, and I am failing to see how this could possibly be used to form an attack. Sure - taking the provider down is bad - but that happens due to unscheduled downtime every other day?

a5withtrrs 3y ago
From the article: >> Speaking with Vince (the administrator of the .ai zone) over WhatsApp, we confirmed that compromising this server would give us full control over any .ai domain: >> Once administrative access is gained to the CoCCA application, it is possible to control the nameservers for every domain for that ccTLD. The point is to control domains in a ccTLD. Arbitrary domain hijacking is bad...
opello 3y ago
The screenshot of the WhatsApp conversation says they'd need admin on the web application. I agree it wasn't clear if they'd gotten that. Looks like it was via the backup files: https://news.ycombinator.com/item?id=36305699 https://news.ycombinator.com/item?id=36305699
archgoon 3y ago
[dead]