12 ms·

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our researc

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire. If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association.

declan_roberts 2y ago
Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.
- salad-tycoon 2y ago
  A lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument. Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.
- ganoushoreilly 2y ago
  I actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar. Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.
- shafoshaf 2y ago
  And a second for when your main domain gets banned for spam for innocuous reasons.
- playingalong 2y ago
  I think it's a sane practice to keep the marketing landing page on a separate domain than the product in case of SaaS.
  - declan_roberts 2y ago
    Why? I always get frustrated when I end up in some parallel universe of a website (like support or marketing) and I can't easily click back to the main site.
    - playingalong 2y ago
      The non-technical reason is that these are usually owned by different teams in your org (after you mature beyond a 5-person startup). The technical perspective is that things like wildcard subdomains (e.g. to support yourcustomername.example.com), or DNSSec if your compliance requires it, etc. cause an extra burden if done for these two use-cases at a time. > can't easily click Http pages don't have problems with having a link to example.net from within example.com. Or the opposite. Seems like an unrelated problem.
    - thayne 2y ago
      One potential reason is that marketing teams often want to do things that are higher risk than you may want to do on your main application domain. For example, hosting content (possibly involving a CNAME pointing to a domain outside your control) on a third party platform. Using a framework that may be less secure and hardened than your main application (for example WordPress or drupal with a ton of plugins) using third party Javascript for analytics, etc.
  - stagalooo 2y ago
    Could you elaborate on why? The companies I have worked for have pretty much all used domain.com for marketing and app.domain.com for the actual application. What's wrong with this approach?
    - darkr 2y ago
      If there’s any scope for a user to inject JavaScript, then potentially this gives a vector of attack against other internal things (e.g admin.domain.com, operations.domain.com etc)
- craftkiller 2y ago
  Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/ https://github.blog/engineering/githubs-csp-journey/
  - joelanman 2y ago
    interesting, why is this?
    - deleted 2y ago
      [deleted]
    - varun_ch 2y ago
      I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff), csp rules exist, but it's a lot easier to sandbox users content entirely like this.
      - wiradikusuma 2y ago
        I'm wondering, many SaaS offer companyname.mysaas.com. Is that totally secure?
        _cenw 2y ago
        If it's on the PSL it gets treated similarly to second level "TLDs" like co.uk.
        mhio 2y ago
        PSL = Public Suffix List https://publicsuffix.org/ https://publicsuffix.org/
- theendisney 2y ago
  I felt the need to get in addition to (shall we say) foo-bar.nl the foobar.nl the foo-bar.com and foobar.com because I dont want a competitor picking up those and customers might type it like that.
- oasisbob 2y ago
  Don't forget about infrastructure domains, static-asset domains, separation of product domains from corporate domains ... there are plenty of good reasons to use multiple domains, especially if you're doing anything with the web where domain hierarchies and the same-origin policy are so critical to the overall security model.
- frosting1337 2y ago
  For whatever it's worth, subdomain takeovers are also a thing and bug bounty hunters have been exploiting it for years.
swiftcoder 2y ago
Even Google managed to (briefly) fuck that one up. https://money.cnn.com/2016/01/29/technology/google-domain-purchase/index.html https://money.cnn.com/2016/01/29/technology/google-domain-pu...
yumraj 2y ago
> If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association. Please elaborate... Also, what about personal domains? Does it apply there as well?
- judge2020 2y ago
  People bookmark stuff. Random systems (including ones you don’t own) have hardcoded urls. Best to pay for it forever since it’s so low of a cost and someone taking over your past domain could lead to users getting duped. Personal domains are up to you.
- MontagFTB 2y ago
  As per the article, the old domain expired and was picked up by a third party for $20. Said domain was hard-coded into a vast number of networking tools never to be updated again, effectively letting the new domain owner unfettered access into WHOIS internals.
- liquidgecka 2y ago
  My brother used to own <our uncommon family name>.com and wrote on it a bunch. Eventually he bailed out and let it expire. It turned into a porn site for a few years and now its for sale for like $2k from some predatory reseller.
  - llasse 2y ago
    Same happened to my personal website for which I purchased the domain when I was 14 (long time ago) and at some point decided that a .com domain is ridiculous for a personal website. Chinese porn site it was thereafter …
    - 8n4vidtmkvmk 2y ago
      My old domain remains unregistered... Lucky me. I guess my last name was uncommon enough!
ohashi 2y ago
This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.
- mapt 2y ago
  See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.
  - astrange 2y ago
    Not regulated? They're portable because they're regulated.
    - klingoff 2y ago
      I'd assume regulated in the sense of identity verification and transactions. There's no legal basis for needing a north American phone number, but good luck with any US obligations if you are without one.
      - sneak 2y ago
        Thankfully you can still get them without ID, for cash. Unlike in Germany, where you can’t get one without a passport or ID card.
        notpushkin 2y ago
        I’m wondering how feasible would it be to just use a SIM card from another country (e.g. in Estonia, you can get a prepaid card for 1 € that works in EU roaming just fine, with domestic-like prices on local calls). How many services in Germany require you to use specifically German number?
ryanmcbride 2y ago
But if companies did that then I never would have been able to buy coolchug.com!
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
throwaway2037 2y ago
I like the point you are making in this post. It makes me think about the Backblaze blog posts where they discuss the likelihood of enough drive failures to lose user data. Then, they decided the calculation result hardly matters, because people are more likely to forget to pay due to an expired credit card or email spam filtering (missed renewal reminders!). How do mega corps remember to pay their domain bills? Do they pay an (overpriced) registrar for "infinity" years of renewals? This seems like a genuinely hard business operations problem.
- kccqzy 2y ago
  Mega corps have their own top-level domains. For example there're .apple, .google, .amazon, .youtube and probably some more I had forgotten. Even when companies don't have their own top-level domain, they can have their own domain registrar. For example "facebook.com" is registered with "registrarsafe.com" as registrar. The latter registrar is a wholly owned subsidiary of Facebook. I learned this from this HN thread https://news.ycombinator.com/item?id=28751497 https://news.ycombinator.com/item?id=28751497
- grogenaut 2y ago
  The megacorp that I work at requires us to surrender domain names payment that we own to a central authority who takes care of this in perpetuity. Any domain names we buy we also have to tell them about it. Your triple boss gets a good Stern talking to if you're not following these procedures.
- Symbiote 2y ago
  Services like https://www.markmonitor.com/ https://www.markmonitor.com/ sort this out. Notice that google.com is registered with them.
- 8n4vidtmkvmk 2y ago
  Not all registrars are super evil. Sometimes the domain just goes down and then your customers start barking and you have a chance to renew it. Found this out when some of our emails started bouncing...

declan_roberts 2y ago

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

salad-tycoon 2y ago
A lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument. Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.
ganoushoreilly 2y ago
I actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar. Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.
shafoshaf 2y ago
And a second for when your main domain gets banned for spam for innocuous reasons.
playingalong 2y ago
I think it's a sane practice to keep the marketing landing page on a separate domain than the product in case of SaaS.
- declan_roberts 2y ago
  Why? I always get frustrated when I end up in some parallel universe of a website (like support or marketing) and I can't easily click back to the main site.
  - playingalong 2y ago
    The non-technical reason is that these are usually owned by different teams in your org (after you mature beyond a 5-person startup). The technical perspective is that things like wildcard subdomains (e.g. to support yourcustomername.example.com), or DNSSec if your compliance requires it, etc. cause an extra burden if done for these two use-cases at a time. > can't easily click Http pages don't have problems with having a link to example.net from within example.com. Or the opposite. Seems like an unrelated problem.
  - thayne 2y ago
    One potential reason is that marketing teams often want to do things that are higher risk than you may want to do on your main application domain. For example, hosting content (possibly involving a CNAME pointing to a domain outside your control) on a third party platform. Using a framework that may be less secure and hardened than your main application (for example WordPress or drupal with a ton of plugins) using third party Javascript for analytics, etc.
- stagalooo 2y ago
  Could you elaborate on why? The companies I have worked for have pretty much all used domain.com for marketing and app.domain.com for the actual application. What's wrong with this approach?
  - darkr 2y ago
    If there’s any scope for a user to inject JavaScript, then potentially this gives a vector of attack against other internal things (e.g admin.domain.com, operations.domain.com etc)
craftkiller 2y ago
Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/ https://github.blog/engineering/githubs-csp-journey/
- joelanman 2y ago
  interesting, why is this?
  - deleted 2y ago
    [deleted]
  - varun_ch 2y ago
    I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff), csp rules exist, but it's a lot easier to sandbox users content entirely like this.
    - wiradikusuma 2y ago
      I'm wondering, many SaaS offer companyname.mysaas.com. Is that totally secure?
      - _cenw 2y ago
        If it's on the PSL it gets treated similarly to second level "TLDs" like co.uk.
        mhio 2y ago
        PSL = Public Suffix List https://publicsuffix.org/ https://publicsuffix.org/
theendisney 2y ago
I felt the need to get in addition to (shall we say) foo-bar.nl the foobar.nl the foo-bar.com and foobar.com because I dont want a competitor picking up those and customers might type it like that.
oasisbob 2y ago
Don't forget about infrastructure domains, static-asset domains, separation of product domains from corporate domains ... there are plenty of good reasons to use multiple domains, especially if you're doing anything with the web where domain hierarchies and the same-origin policy are so critical to the overall security model.
frosting1337 2y ago
For whatever it's worth, subdomain takeovers are also a thing and bug bounty hunters have been exploiting it for years.

swiftcoder 2y ago

Even Google managed to (briefly) fuck that one up. https://money.cnn.com/2016/01/29/technology/google-domain-purchase/index.html https://money.cnn.com/2016/01/29/technology/google-domain-pu...

yumraj 2y ago

> If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association. Please elaborate... Also, what about personal domains? Does it apply there as well?

judge2020 2y ago
People bookmark stuff. Random systems (including ones you don’t own) have hardcoded urls. Best to pay for it forever since it’s so low of a cost and someone taking over your past domain could lead to users getting duped. Personal domains are up to you.
MontagFTB 2y ago
As per the article, the old domain expired and was picked up by a third party for $20. Said domain was hard-coded into a vast number of networking tools never to be updated again, effectively letting the new domain owner unfettered access into WHOIS internals.
liquidgecka 2y ago
My brother used to own <our uncommon family name>.com and wrote on it a bunch. Eventually he bailed out and let it expire. It turned into a porn site for a few years and now its for sale for like $2k from some predatory reseller.
- llasse 2y ago
  Same happened to my personal website for which I purchased the domain when I was 14 (long time ago) and at some point decided that a .com domain is ridiculous for a personal website. Chinese porn site it was thereafter …
  - 8n4vidtmkvmk 2y ago
    My old domain remains unregistered... Lucky me. I guess my last name was uncommon enough!

ohashi 2y ago

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

mapt 2y ago
See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.
- astrange 2y ago
  Not regulated? They're portable because they're regulated.
  - klingoff 2y ago
    I'd assume regulated in the sense of identity verification and transactions. There's no legal basis for needing a north American phone number, but good luck with any US obligations if you are without one.
    - sneak 2y ago
      Thankfully you can still get them without ID, for cash. Unlike in Germany, where you can’t get one without a passport or ID card.
      - notpushkin 2y ago
        I’m wondering how feasible would it be to just use a SIM card from another country (e.g. in Estonia, you can get a prepaid card for 1 € that works in EU roaming just fine, with domestic-like prices on local calls). How many services in Germany require you to use specifically German number?

ryanmcbride 2y ago

But if companies did that then I never would have been able to buy coolchug.com!

deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

throwaway2037 2y ago

I like the point you are making in this post. It makes me think about the Backblaze blog posts where they discuss the likelihood of enough drive failures to lose user data. Then, they decided the calculation result hardly matters, because people are more likely to forget to pay due to an expired credit card or email spam filtering (missed renewal reminders!). How do mega corps remember to pay their domain bills? Do they pay an (overpriced) registrar for "infinity" years of renewals? This seems like a genuinely hard business operations problem.

kccqzy 2y ago
Mega corps have their own top-level domains. For example there're .apple, .google, .amazon, .youtube and probably some more I had forgotten. Even when companies don't have their own top-level domain, they can have their own domain registrar. For example "facebook.com" is registered with "registrarsafe.com" as registrar. The latter registrar is a wholly owned subsidiary of Facebook. I learned this from this HN thread https://news.ycombinator.com/item?id=28751497 https://news.ycombinator.com/item?id=28751497
grogenaut 2y ago
The megacorp that I work at requires us to surrender domain names payment that we own to a central authority who takes care of this in perpetuity. Any domain names we buy we also have to tell them about it. Your triple boss gets a good Stern talking to if you're not following these procedures.
Symbiote 2y ago
Services like https://www.markmonitor.com/ https://www.markmonitor.com/ sort this out. Notice that google.com is registered with them.
8n4vidtmkvmk 2y ago
Not all registrars are super evil. Sometimes the domain just goes down and then your customers start barking and you have a chance to renew it. Found this out when some of our emails started bouncing...