How I hijacked the top-level domain of a sovereign state • Hacker News Board

Re: How I hijacked the top-level domain of a sovereign state

#11

Post by toshk » Fri, Jan 15, 2021, 3:01 PM UTC

xwdv wrote: post #3

It pisses me off that for something of this magnitude this guy will probably only be paid no more than a couple thousand dollars, if at all. He still has no response.

I work for a few a cities in Europe, and happen to know one of the cities had a site with an sql injection issue. An external person found and let the city know but didn't want to reveal the specifics before getting money. The city has no bounty program and for some people in the City it came across as if the guy was distorting them. The guy probably felt like he didn't get money for his work. Probably both have a point. In the end it got resolved.

Re: How I hijacked the top-level domain of a sovereign state

#12

Post by saadalem » Fri, Jan 15, 2021, 3:03 PM UTC

Many times, you scan an IP, look at the easy hackable websites that may be on the same IP, you upload the shell and try to go all-in and take over all the websites in same IP, ez and I dont't know why we still face these problems that are outdated !

Re: How I hijacked the top-level domain of a sovereign state

#13

Post by yaveti » Fri, Jan 15, 2021, 3:05 PM UTC

fjiizrsdfjjj wrote: post #5

Shouldn't he have acted when he noticed the soonish expiration instead of hoping to be the only one watching for expiration?

It's not uncommon for organisations to be late with renewing their domains and you probably don't want to send false alarms.

Re: How I hijacked the top-level domain of a sovereign state

#14

Post by prosaic-hacker » Fri, Jan 15, 2021, 3:06 PM UTC

xwdv wrote: post #3

It pisses me off that for something of this magnitude this guy will probably only be paid no more than a couple thousand dollars, if at all. He still has no response.

It may not directly pay but his reputation as Security Expert is enhanced.

I don't know if "Big Internet" (ICANN, IANA, IETF, RIRs) does not have its own security group like the Commercial companies do (Project Zero, various EH companies). RFC3013???

We have to depend on people who can take time to look for exploits in exchange for reputation.

Re: How I hijacked the top-level domain of a sovereign state

#15

Post by jaywalk » Fri, Jan 15, 2021, 3:07 PM UTC

0x0 wrote: post #4

Could this be leveraged to hijack additional TLDs? If any other TLD uses a ".cd" NS, like .cd used a ".com" NS...? (Are there any?)

Yes, although it's hard to imagine any TLD using .cd for NS.

It would also be less effective unless that TLD was using .cd for ALL of it's NS records.

Re: How I hijacked the top-level domain of a sovereign state

#16

Post by lovasoa » Fri, Jan 15, 2021, 3:10 PM UTC

toshk wrote: post #11

xwdv wrote: post #3

It pisses me off that for something of this magnitude this guy will probably only be paid no more than a couple thousand dollars, if at all. He still has no response.

I work for a few a cities in Europe, and happen to know one of the cities had a site with an sql injection issue. An external person found and let the city know but didn't want to reveal the specifics before getting money. The city has no bounty program and for some people in the City it came across as if the guy was distorting them. The guy probably felt like he didn't get money for his work. Probably both have a po…

The guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.

Re: How I hijacked the top-level domain of a sovereign state

#17

Post by dougk » Fri, Jan 15, 2021, 3:11 PM UTC

I had a gut feeling it will be '.cd' before clicking on the article and I was right. Dealing with the state entity (SCPT) that manages this TLD is quite a pain. It's so painful that I've given up managing all the .cd domains I used to own.

.cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.

Re: How I hijacked the top-level domain of a sovereign state

#18

Post by ricardo81 » Fri, Jan 15, 2021, 3:12 PM UTC

Of course, the moral of the story goes beyond TLDs and for nameserver hostnames in general.

Interesting that it wasn't drop-catched, as .com names tend to be. I suppose it didn't have any metrics that'd qualify it for automatic registration.

Not even for 'domain tasting', though I guess it depends on drop catchers setups, which I imagine is just interested in any traffic on port 80/443.

Re: How I hijacked the top-level domain of a sovereign state

#19

Post by lovasoa » Fri, Jan 15, 2021, 3:13 PM UTC

fjiizrsdfjjj wrote: post #5

Shouldn't he have acted when he noticed the soonish expiration instead of hoping to be the only one watching for expiration?

Exactly what I thought. It would have been more ethical to write to them the day BEFORE the expiration (and still buy the domain if they didn't act fast enough).

Re: How I hijacked the top-level domain of a sovereign state

#20

Post by rvnx » Fri, Jan 15, 2021, 3:14 PM UTC

The most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).