Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's Way Too Easy to Get a .gov Domain Name

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 184 posts

Re: It's Way Too Easy to Get a .gov Domain Name

#21

Post by corporate_shi11 »

chatmasta wrote: post #16
RandomBacon wrote: post #3

The title reminds me when someone reported that it was just as easy to get fully-automatic firearms and other military gear from homeland security for free by pretending to be a police department (fake website) and a simple form.

An alarming amount of societal functionality depends on what effectively amounts to the honor system. This is especially true when it comes to any sort of gatekept specialty profession, like coroners for example. There was a great talk at DefCon about faking death: https://m.youtube.com/watch?v=9FdHq3WfJgs

This is an incredibly important comment. You cannot legislate loyalty to the country. You cannot legislate morality. You cannot legislate most of what makes a country a hospitable place to make a life.

Culture matters more than anything else.

Re: It's Way Too Easy to Get a .gov Domain Name

#22

Post by profmonocle »

bonyt wrote: post #17

> A review of the Top 10 most populous U.S. cities indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego. > Yes, you read that right: houston.gov, losangeles.gov, newyorkcity.gov, and philadelphia.gov are all still available. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. A minor nit: Many of these ci…

> Some cities may also use a subdomain of their states domain, which may or may not be a .gov.

This reminds me of how longwinded the domain hierarchy for .us originally was. In MN (not sure if it's the same for every state), city domains were "www.ci.cityname.mn.us". Then the school district's web site was "www.cityname.k12.mn.us". Not only was the order inconsistent (why not www.k12.cityname etc.?) but sometimes the city might be typed differently - i.e. the main Minneapolis site had "minneapolis" in the domain, but the school district had "mpls".

In the primordial days of the web, back before good search engines, this didn't make it very easy to find the school's web site.

Fortunately many governments realized this and moved once .gov became available to cities & states. (or they just used .org). For instance Minneapolis uses minneapolismn.gov, but many are still on the old style domains. The school district uses mpls.k12.mn.us, but at least they've dropped the "www."

Re: It's Way Too Easy to Get a .gov Domain Name

#23

Post by catalogia »

npo9 wrote: post #14
microcolonel wrote: post #5

Earlier quoted context omitted.

There are other more straightforward ways to illegally purchase post-hughes machine guns. This is an extremely high risk scheme.

Yeah but A) military gear is more than automatic weapons. Sometimes they send out things harder to come by than guns to police departments. B) This scheme costs less than pennies on the dollar.

This scheme only makes economic sense if you neglect to factor in the cost of being sent to federal prison for many years.

Re: It's Way Too Easy to Get a .gov Domain Name

#24

Post by soperj »

MereInterest wrote: post #13
forgingahead wrote: post #2

Good reporting, until this paragraph: Now consider what a well-funded adversary could do on Election Day armed with a handful of .gov domains for some major cities in Democrat strongholds within key swing states: The attackers register their domains a few days in advance of the election, and then on Election Day send out emails signed by .gov from, say, miami.gov (also still available) informing residents that bombs…

One of the major political parties in the US has been repeatedly engaging in voter suppression. Is it partisan to observe repeated behavior on one side of the political spectrum, and to extrapolate accordingly? https://en.wikipedia.org/wiki/Voter_suppression_in_the_Unite...

From an outsiders perspective, there's very little difference between both your political parties.

Re: It's Way Too Easy to Get a .gov Domain Name

#25

Post by GeneralMayhem »

forgingahead wrote: post #2

Good reporting, until this paragraph: Now consider what a well-funded adversary could do on Election Day armed with a handful of .gov domains for some major cities in Democrat strongholds within key swing states: The attackers register their domains a few days in advance of the election, and then on Election Day send out emails signed by .gov from, say, miami.gov (also still available) informing residents that bombs…

[flagged]

Re: It's Way Too Easy to Get a .gov Domain Name

#26

Post by markovbot »

profmonocle wrote: post #22
bonyt wrote: post #17

> A review of the Top 10 most populous U.S. cities indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego. > Yes, you read that right: houston.gov, losangeles.gov, newyorkcity.gov, and philadelphia.gov are all still available. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. A minor nit: Many of these ci…

> Some cities may also use a subdomain of their states domain, which may or may not be a .gov. This reminds me of how longwinded the domain hierarchy for .us originally was. In MN (not sure if it's the same for every state), city domains were "www.ci.cityname.mn.us". Then the school district's web site was "www.cityname.k12.mn.us". Not only was the order inconsistent (why not www.k12.cityname etc.?) but sometimes the…

those are called .us locality domains.

ci...us is assigned to the city, there are several other similarly non-obvious assignments, anyone is permitted to register one.

I found this page that talks about it more: http://telecafe.org/smw/.US_Locality_Domains

Re: It's Way Too Easy to Get a .gov Domain Name

#27

Post by hcs »

bonyt wrote: post #17

> A review of the Top 10 most populous U.S. cities indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego. > Yes, you read that right: houston.gov, losangeles.gov, newyorkcity.gov, and philadelphia.gov are all still available. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. A minor nit: Many of these ci…

> LA has .. lacity.org? That’s a bit unexpected

Vs lacounty.gov I guess?

Re: It's Way Too Easy to Get a .gov Domain Name

#28

Post by iamleppert »

Sounds to me like this researcher is going to be brought up on charges. Well deserved charges. We don’t know what he did with this domain before he contacted krebs. He very well could be covering his tracks and creating plausible deniability.

You break the law, you go to jail. Simple as that. They aught to make an example out of him.

Re: It's Way Too Easy to Get a .gov Domain Name

#29

Post by Thorentis »

> “I used a fake Google Voice number and fake Gmail address,” said the source, who asked to remain anonymous for this story but who said he did it mainly as a thought experiment.

I don't think "thought experiment" applies to actually carrying out what you were thinking about.

Re: It's Way Too Easy to Get a .gov Domain Name

#30

Post by girvo »

catalogia wrote: post #23
npo9 wrote: post #14

Earlier quoted context omitted.

Yeah but A) military gear is more than automatic weapons. Sometimes they send out things harder to come by than guns to police departments. B) This scheme costs less than pennies on the dollar.

This scheme only makes economic sense if you neglect to factor in the cost of being sent to federal prison for many years.

Though that's still a risk even if you're getting them on the black market, or manufacturing modifications for legally bought AR-15s et al. yourself
Post reply on HN