Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

361–370 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#361

Post by [deleted] »

darby_nine wrote: post #355
snypher wrote: post #353

Earlier quoted context omitted.

Is this like forcing a tenant out of a property because you wish to raise the rent?

Yea, but in this case the property is very special. I don't think anyone has a right to own a "name" for perpetuity, especially such a short one—that's just extending property rights to a nonsensical place. Granted, I also have zero respect for people who think that trademarks, patents, and copyright are still working to promote rather than stifle the arts and sciences, so I can understand why my above sentiment migh…

[deleted]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#362

Post by fanf2 »

remram wrote: post #313
fanf2 wrote: post #69

This is a fantastic exploit and I am appalled that CAs are still trying to use whois for this kind of thing. I expected the rise of the whois privacy services and privacy legislation would have made whois mostly useless for CAs years ago. > This is the approach taken by whois on Debian. Years ago I did some hacking on FreeBSD’s whois client, and its approach is to have as little built-in hardcoded knowledge as possib…

Wouldn't it be easy for those software project, or a single central authority, to expose that WHOIS list through DNS? mobi.whoisserverlist.info. IN CNAME whois.nic.mobi. org.whoisserverlist.info. IN CNAME whois.publicinterestregistry.org. The presence of a referral mechanism inside the WHOIS protocol strikes me as a little odd.

I believe the original reason for referrals was related to the breakup of the Network Solutions DNS monopoly. This led to the split between TLD registries (who run the DNS servers) and registrars (who sell domain names). To enforce the split for the big TLDs .com, .net, .org, the registration database was also split so that Network Solutions could not directly know the customer who registered each domain, but only the registrar who sold it. This was known as the “thin registry” model. From the whois perspective, this meant that when you asked about example.com, the Network Solutions whois server would only provide information about the registrar; the whois client could follow the referral to get information about the actual registrant from the registrar. Basically all the other TLDs have a “thick registry” where the TLD operator has all the registration details so there’s no need for whois referrals to registrars.

As a result, a whois client needs referral support. The top level IANA whois server has good referral data, so there isn’t much to gain from trying to bypass it.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#363

Post by me-vs-cat »

Semaphor wrote: post #317
firefoxd wrote: post #311

Earlier quoted context omitted.

It's now possible. I work for a mvno that was recently acquired. We have a $5 pause plan. It has no data, voice or text, it just keeps your line active.

Wow. I’d save ~$0.52 (tax included) over my current plan with unlimited voice, and texts, and 5GB data…

Which provider do you use?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#364

Post by mulmen »

darby_nine wrote: post #355
snypher wrote: post #353

Earlier quoted context omitted.

Is this like forcing a tenant out of a property because you wish to raise the rent?

Yea, but in this case the property is very special. I don't think anyone has a right to own a "name" for perpetuity, especially such a short one—that's just extending property rights to a nonsensical place. Granted, I also have zero respect for people who think that trademarks, patents, and copyright are still working to promote rather than stifle the arts and sciences, so I can understand why my above sentiment migh…

Ok please stop posting as darby_nine. I’d like my turn with that identity. I think it fits with some objectionable conspiracy theories I’d like to promote.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#365

Post by mulmen »

samatman wrote: post #357
snypher wrote: post #353

Earlier quoted context omitted.

Is this like forcing a tenant out of a property because you wish to raise the rent?

Countries owning their ccTLDs seems basically correct to me. If you rent a `.tm` domain, you're doing business with the nation of Turkmenistan: might want to think about whether a TLD pun is worth taking on that relationship.

How do you know the TLD was a pun and not an otherwise appropriate use of the .tm TLD? By your logic why would anyone use a ccTLD?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#366

Post by 8n4vidtmkvmk »

llasse wrote: post #254
liquidgecka wrote: post #213

Earlier quoted context omitted.

My brother used to own .com and wrote on it a bunch. Eventually he bailed out and let it expire. It turned into a porn site for a few years and now its for sale for like $2k from some predatory reseller.

Same happened to my personal website for which I purchased the domain when I was 14 (long time ago) and at some point decided that a .com domain is ridiculous for a personal website. Chinese porn site it was thereafter …

My old domain remains unregistered... Lucky me. I guess my last name was uncommon enough!

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#367

Post by 8n4vidtmkvmk »

throwaway2037 wrote: post #294
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

I like the point you are making in this post. It makes me think about the Backblaze blog posts where they discuss the likelihood of enough drive failures to lose user data. Then, they decided the calculation result hardly matters, because people are more likely to forget to pay due to an expired credit card or email spam filtering (missed renewal reminders!). How do mega corps remember to pay their domain bills? Do t…

Not all registrars are super evil. Sometimes the domain just goes down and then your customers start barking and you have a chance to renew it.

Found this out when some of our emails started bouncing...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#368

Post by tptacek »

dgoldstein0 wrote: post #358
tptacek wrote: post #259

Earlier quoted context omitted.

No. IPv6 deployment is tricky (though accelerating), but not all that scary, because it's easy to run IPv4 and IPv6 alongside each other; virtually everybody running IPv6 does that. The problem with DNSSEC is that deploying it breaks DNS . Anything that goes wrong with your DNSSEC configuration is going to knock your whole site off the Internet for a large fraction of Internet users.

I didn't say deploying IPv6 was scary. Very aware that dual stack deployment is a thing. It's really the only sane way to do the migration for any sizable network, but obviously increases complexity vs a hopeful future of IPv6 only. Good point about dnssec, but this is par for the course with good security technologies - it could break things used to be an excuse for supporting plaintext http as a fallback from https…

I don't think the failure modes for DNSSEC really are par for the course for security technologies, just for what it's worth; I think DNSSEC's are distinctively awful. HPKP had similar problems, and they killed HPKP.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#369

Post by hsbauauvhabzb »

darby_nine wrote: post #355
snypher wrote: post #353

Earlier quoted context omitted.

Is this like forcing a tenant out of a property because you wish to raise the rent?

Yea, but in this case the property is very special. I don't think anyone has a right to own a "name" for perpetuity, especially such a short one—that's just extending property rights to a nonsensical place. Granted, I also have zero respect for people who think that trademarks, patents, and copyright are still working to promote rather than stifle the arts and sciences, so I can understand why my above sentiment migh…

So instead of fair use you’d like to reserve domains for the rich?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#370

Post by Marsymars »

Wowfunhappy wrote: post #270
semiquaver wrote: post #269

Earlier quoted context omitted.

Phone number portability is required by law in the US since 2003. See 47 U.S.C. § 251(b)(2) https://www.fcc.gov/general/wireless-local-number-portabilit...

What if you need to stop paying for a phone bill entirely though? Maybe you're living paycheck to paycheck and money is just too tight this month. That's what I think GP was talking about. Is it possible to "park" your phone number until you can start a new plan?

You can port your number to NumberBarn and park it for $2/month. Other services probably exist, but I signed up to NumberBarn ages ago and haven't had any issues the handful of times I've used them.
Post reply on HN