Indictment Shows Ease of Hijacking Domain Name
Friday, November 20th, 2009
Three hackers indicted for hijacking domain name.
An indictment against three hackers involved in hijacking the Comcast.net domain name last year shows how easy it is to pull it off: just get access to the administrative contact’s email address.
The U.S. government has charged three hackers with doing just that, and using the email address to change the nameservers on Comcast.net at domain name registrar Network Solutions.
Blame the hackers, but also Comcast for not having security measures in place with their registrar. Moniker, Fabulous, and GoDaddy each have optional security tools available that make it harder to make changes to DNS.
If I were a registrar, I’d offer a gold standard security measure to big companies for critical domains. It would be expensive — something like $10,000 a year — but would guarantee that incidents like this don’t happen.
In order to make any change to the DNS or ownership of a domain, a representative of the registrar would literally fly to the headquarters of the company to meet in person. Over the top? I don’t think so. If I were the CTO of a Fortune 500 company, I’d gladly pay this amount as an insurance policy.
No related posts.
Tags: comcast.net, domain hijacking, domain theft, lawsuits
Indictment Shows Ease of Hijacking Domain Name – http://tinyurl.com/ydv6lr9
Wouldn’t it be easier to accredit themselves…?
Windstream gave my password to a hacker. I think he just called and faked his identity to the representative and they simply gave it to him.
He then ran around creating a mess but I caught him early and stopped the damage after going on race against time to make sure all domains were locked down and other banking info. was not compromised, plus everything else.
I’ve put tons of protective measures in place now, but it now is more of a hassle for me b/c of all the crazy keywords and things that are now locked down that require a phone call or some hoop to jump though to do a simple process.
It’s a big problem these hackers.
Oops….I meant “crazy passwords”.
[...] Visit link: Domain Name Wire » News » Indictment Shows Ease of Hijacking … [...]
“Wouldn’t it be easier to accredit themselves…?”
Unasi,
That was my first thinking also.
But then I realized someone from Comcast would have to guard the Registrar which opens a whole new can of worms such as trust issues, competency, espionage, cost issues, etc.
I tried the gold-plated registrar idea when I ran NameEngine, and again at VeriSign after they bought NameEngine. It had lots of ultra-manual safeguards; I had it all worked out.
The idea never went anywhere; brand owners thought (and, I’m sure, think) I should be keeping their name safe anyway. Besides (they would say) it only costs $7 at GoDaddy.
CEOs don’t make these decisions; legal departments do, and they have budgets. They’re already gnashing their teeth that they should have to spend any money on procedures to safeguard their marks on the Internet, and they see registrars as do-nothing functionaries who exist to exploit the brand owner’s misfortunes.
By all means try it — let me know what happens…
Antony
Hi, Is that not what Mark Monitor does? I phoned them to inquire, and a minimum of $10,000 is required to just register domains there. But that would be a large portfolio, though Howard Kantor of Mark Monitor said it could represent as few as 50-25 domains.
It wouldn’t happen if The company had not
1. An overview of All their domains
2. Updated standard ownership detail in The Whois
I do believe that registrars should assume more responsibility to educate their clients about good domain practice
Re: “Blame the hackers, but also Comcast for not having security measures in place with their registrar.”
What makes you think such measures were NOT in place? Were there other domains similarly hijacked in subsequent months?
“What makes you think such measures were NOT in place? Were there other domains similarly hijacked in subsequent months?”
The indictment makes me “know” this.