Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

281–290 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#281

Post by Noumenon72 »

detourdog wrote: post #13
sebstefan wrote: post #8

>The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained from the WHOIS server via the PHP ‘eval’ function, allowing instant RCE from any malicious WHOIS server. I don't want to live on this planet anymore

Always look on the bright side of Life. The non-sensicalness of it is just a phase. Remember the Tower of Babel didn't stop humanity. Here is a link that was posted a few days ago regarding how great things are compared to 200 years ago. Ice cream has only become a common experience in the last 200 years.. https://ourworldindata.org/a-history-of-global-living-condit...

Someone may have posted a link to it a few days ago, but the link is from 2016 with a partial update last February.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#282

Post by joecool1029 »

j-bos wrote: post #280
hsbauauvhabzb wrote: post #273

Earlier quoted context omitted.

It’s worse if you stop using the phrase ‘buy’ and instead use the term ‘rent’. A DNS provider could 10,000x your domain cost and there’s nothing you can do about it.

Can they? I thought ICANN prevented such steep increases?

Only for a few TLD's, stuff like ccTLD's there's no limit on how much a registry can charge.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#283

Post by amerkhalid »

mapt wrote: post #236
ohashi wrote: post #219

Earlier quoted context omitted.

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.

And try sharing a phone number. Almost every service assumes that everyone in a household has their own phone. Which is of course not true.

It just makes many services such as Credit Karma unavailable to anyone but the first person to signup.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#285

Post by pimlottc »

spathi_fwiffo wrote: post #252
pimlottc wrote: post #4

As a reminder, RCE = remote code execution (it’s not defined in the article). https://www.cloudflare.com/learning/security/what-is-remote-...

It is defined in the article the first time it is used in the text. Maybe they read your comment and fixed it?

Perhaps so! I didn’t see it defined anywhere earlier.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#286

Post by silisili »

lilyball wrote: post #264
lovasoa wrote: post #206

> $ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l Oh cool they saved the logs in a database ! Wait... |sort|uniq|wc -l ?? But why ?

yeah, they could have done `sqlite …|sort -u|wc -l` instead and saved themselves a process invocation!

Hey now if you're just gonna count lines no need to sort it at all.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#287

Post by frosting1337 »

declan_roberts wrote: post #102
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

For whatever it's worth, subdomain takeovers are also a thing and bug bounty hunters have been exploiting it for years.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#288

Post by anabab »

forgotpwd16 wrote: post #176

Very cool work. >The dotmobiregistry.net domain, and whois.dotmobiregisry.net hostname, has been pointed to sinkhole systems provided by ShadowServer that now proxy the legitimate WHOIS response for .mobi domains. If those domains were meant to be deprecated should be better to return a 404. Keeping them active and working like normal reduces the insensitive to switch to the legitimate domain.

The article implies they were broken for a few years and lots of clients did not notice this.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#289

Post by lilyball »

silisili wrote: post #286
lilyball wrote: post #264

Earlier quoted context omitted.

yeah, they could have done `sqlite …|sort -u|wc -l` instead and saved themselves a process invocation!

Hey now if you're just gonna count lines no need to sort it at all.

you need to sort it in order to uniq it, because uniq only removes duplicate consecutive lines.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#290

Post by ycombinatrix »

deisteve wrote: post #209
tomaskafka wrote: post #2

O.M.G. - the attack surface gained by buying a single expired domain of an old whois server is absolutely staggering.

[flagged]

I would rather own a WHOIS server than a "decent sized quantized LLM"...
Post reply on HN