Slashdot Log In
New Rules Make Domain Hijacking Easier
Posted by
timothy
on Wed Nov 10, 2004 01:08 AM
from the and-ease-of-use-is-important dept.
from the and-ease-of-use-is-important dept.
Tanktalus writes "Netcraft seems to have a little ditty about new rules from ICANN that take effect on Friday making it easier to hijack domain names. Essentially, if someone tries to take your domain, and you don't answer within 5 days, they now assume you are okay with the transfer. Previously, the default answer was no, and you had to explicitly state your acceptance of the domain transfer. Owners of small domains, beware: no more computerless vacations that last more than 4 days at a time!"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Some registrars will protect you (Score:4, Informative)
Re:Some registrars will protect you (Score:4, Insightful)
Parent
Re:Some registrars will protect you (Score:3, Interesting)
Re:Some registrars will protect you (Score:3, Interesting)
Re:Some registrars will protect you (Score:5, Informative)
Reading though this thread, I already am impressed with Joker, as they auto-locked everyone's domains, it appears. Very nice of them. I've used Verisign/Network Solutions, GoDaddy, Dotster, and one other I forget.
Network Solutions is terrible. I admit, they do have customer support, and when I call, I rarely wait more than a minute to talk to someone. That's good. But they drag their feet on anything that will cost them money or lose them money (such as trying to transfer AWAY from them). Because of their long, long agreement (that took days for me to read through properly) and because they took soooo long to automate even the simplest of changes, I just transferred my last domain away from them 2 nights ago. What a mess -- the site was down, so I called and they couldn't do a thing, so I waited for it to come back up and then unlocked the domain myself, but even though it showed unlocked, they kept rejecting my attempts to move the domain! Eventually after more calls and waiting, it finally went through. Ugh.
Dotster was fine, but I moved away from them about 2 years ago. I don't remember the major reason, but it may have been that GoDaddy was just cheaper then.
GoDaddy is similar to Dotster, but with TONS of ads. I mean, so many that it will drive you insane. However, I found the trick: I've listed all my sites privately, so my email and address never appears in a listing. Also, I have no problem saying "no thanks" to all the ads that appear when I order something. And finally, I found all the knobs and switches that disable all the marketing emails, spammy offers, and other lameness that they try to email you. After doing all this, I'm fairly happy. I never get email unless it's something official, I have low rates, and everything seems to be automated. But this solution is not for people with a low tolerance for configuring and tweaking the ads off.
For the company that I cannot remember, all I can say is: stay away from small registrars, especially ones that come with a Web hosting package. I bought a hosting package, needed a domain name, and used their little built-in registrar. What a mess. No features, and the registrar was tightly coupled with the hosting, so moving away was miserable. Stick to the known names you'll see mentioned a lot here.
Parent
Re:Some registrars will protect you (Score:5, Interesting)
I suppose my one catch is, they seem to be somewhat Euro-centric (this, of course coming from my US-centric mind), so some of my new users are confused by if they need to pay VAT, or why some of the transfer processes are bound by German (I think) telecom laws designed to protect the consumer (e.g., for one action on a domain, you used to be required to sign a form and fax it to them). It works out well, though, since they protect the user from any sort of fudgery as mentioned above.. like five day steals.
Parent
Re:Some registrars will protect you (Score:3, Informative)
I would like to hear how other people solve the issue with the contact info on the domain records. Using fake information comes to mind but still, maybe there is a way to handle this without everyone knowing where I leave...
Re:Some registrars will protect you (Score:5, Informative)
Then, on the server side, I set each of these email address to reject all emails not from those registrars themselves. For example, the Network Solutions one reject emails without any of the following in the "From:" line:
Network Solutions
netsol.com
networksolutions.com
Veri
The GoDaddy one rejects emails without:
godaddy.com
supportwebsite.com
gandi.net
And so on. Not a single spam email has made it through my domain contact email addresses since I set this up just under two years ago, and according to my stats, around 419 per week have been blocked (just over 41,000 total messages so far). And yet at the same time, I've gotten every email message when my domains have been coming up for renewal, or when I have made changes to them. So it seems to work well.
You just need to make sure that you include all applicable domain names in the filters, because Network Solutions (for example) sends emails from several domain names.
Of course spammers could get around this by spoofing the "From" line to pretend to be from a registrar. But, in practice, I haven't seen this happen yet. Hopefully SPF [pobox.com] or some other such standard will become prevalent enough by the time that happens that it will be a non-issue.
Parent
Re:Some registrars will protect you (Score:3, Insightful)
Re:Some registrars will protect you (Score:3, Insightful)
Registering a domain name at the same ISP who is hosting the website, etc., is a VERY bad idea. It makes it REALLY difficult to switch to a different hosting ISP. It may be convenient to do such things for little throwaway domains like "thesmithfamily.com" but for anything important you want to use a real registrar so that you are not locked in.
Re:Some registrars will protect you (Score:5, Informative)
The first thing I heard about these new rules was in some emails from Joker the other day telling me they were locking my domains for me. As far as tech support goes, I've honestly never needed any; I can control every aspect of my domains via a reasonably well designed web interface.
Parent
Hmmm... (Score:5, Funny)
The question is (Score:5, Funny)
(this is meant as a lighthearted jest).
Parent
Re:The question is (Score:5, Funny)
Stories are posted only once.
Parent
simple solution (Score:4, Insightful)
Re:simple solution (Score:4, Funny)
every Tues and Fri
echo "I refuse permission to transfer domainname.com ">
if a few million domain names did likewise...
Parent
Re:simple solution (Score:5, Funny)
Lets all overwrite our sendmail daemons with one line of text. That'll show em!
Parent
Re:simple solution (Score:4, Insightful)
Parent
Simpler solution (Score:5, Funny)
2. Ask to buy their domain
3. Wait 'till they can't answer....
4. You're done!
Parent
Re:Simpler solution (Score:4, Insightful)
Done.
Parent
Lock it to block it! (Score:4, Informative)
This advice is a bit extreme... you can rest easy so long as you turn on domain locking at your registrar. That'll default all requests for transfer to a fail until it's removed... so all you need to do is keep your password to your domain registrar accout from falling into enemy hands.
Maybe this is a good time to educate the casual website operator about the domain locking feature, and what it's useful for. The new system's assumption is if your domain is unlocked, you're sending out a signal that you're intending for a transfer to happen soon. Maybe the rules should have locking as a default-on thing, but they don't so it's buyer beware for now.
Re:Lock it to block it! (Score:5, Interesting)
Parent
Re:Lock it to block it! (Score:5, Informative)
The Fucking Article (and even more so the editorial comments here) is WRONG.
The linked Icann paper's first line is "Registered Name Holders must be able to transfer their domain name registrations between Registrars". NOTHING TO DO with transferring ownership of domains; but of the registrars. Could be nasty, and even a first step to having the domain hijacked, but the ownership of the domain is unaffected.
Parent
w00t w00t (Score:4, Funny)
Re:w00t w00t (Score:3, Funny)
Re:w00t w00t (Score:3, Funny)
You know this is slashdot and chance of that happening is ZERO.
[for mathematicians, it is zero, not a near zero but a real zero.]
Light at the end of the Tunnel (Score:4, Insightful)
Which should be in about 7 days.
Re:Reach out and hijack someone. (Score:5, Funny)
Suppose we sent a transfer request every minute, on the minute.
If we submitted ENOUGH of them, surely they'll forget to reply to ONE of them. And we'll have the domain name, cleanly by their own policies. They'd have no means of recourse.
Parent
Nothing has changed (Score:5, Informative)
Right. Mod parent up. (Score:5, Informative)
Note that this isn't about transferring a domain from one owner to another. It's about transferring a domain from one registrar to another while keeping the same owner. Transfers of ownership come under different rules.
Parent
Joker.com auto-locked my domain (Score:5, Informative)
I had no idea about the regulations until they emailed me first. First they helped me transfer my domain away from a bad registrar, now they help me through new regulations without me lifting a finger.
Buyer beware of other services, but that's why you sign up with a reliable service with good references!
Re:Joker.com auto-locked my domain (Score:4, Insightful)
Was that your idea, or theirs? :-)
Parent
SPAM? (Score:5, Interesting)
Hello sirs,
Writing this letter comes at a times of great anguishes to my community. We have obtained funds in the amount of US$3,000,000 from the Nigerian government, after the passing of Prince Montebu Wilson, to whom we are the singlest heirs. However, due to political difficulties we are unable to secure the actual cash moneys ourselves. We require your assistance, for which we would thankfully provide a commission of $500,000 for your troubles. In order for this transaction to be completed, we hereby requests that your domain, www.coolinternetstuffthatisgreatandfun.com, be transferred to us immediately. Lack of action will be assumed as an affirmative response after five days.
Do YOU ever read more than a few words into those?
Makes a change (Score:5, Insightful)
Network solutions has an outdated email address listed for the admin and technical contact, and in order for you to change it the require faxed copies of a passport, credit card, finger prints, a 500ml sample of your blood and any children or pets you might have as hostages.
2 years and several attempts later and, although they occassionally manage to transfer the domain OK, the email address is still fricken wrong. These new ICANN rules could make my life much easier next time we change ISPs.
Possible motivation (Score:3, Interesting)
This is actually a good thing. (Score:5, Informative)
The sign-up form very cleverly asks you for the information to transfer your domain name TO them.
When trying to renew the domain name, I was told by their employees that it is against their policy to release domain names. They let people transfer them in, but they will not release them to other registrars.
After digging a little deeper, they are a partner of Register.com. It took hours (literally) to get someone with enough authority on the phone (at register.com) to release the lock that they had on the account so a transfer would work.
Thankfully, the domain name was finally transferred and the guy at Register.com agreed that what they were doing was unethical....though that didn't stop them from making it a complete PITA.
Original poster didn't RTFA!! (Score:5, Informative)
This is a good thing people! It helps to ensure that domain owners can transfer their registrations when they so wish. In fact, the domain owner has to first request the transfer before it even gets this far.
Sheesh.
GOOD thing, not BAD thing. (Score:5, Informative)
- The registrant or domain owner;
- The losing registrar;
- The gaining registrar.
- The central registry - central repository of records.
Got that?Okay, the way a transfer was supposed to work was as follows:
- The domain owner submits a transfer request to the gaining registrar
- The gaining registrar was to seek confirmation of the transfer from the domain owner, based on existing whois information, and independent of the request.
- Having received such confirmation, they notify the central registry that the transfer is valid.
- The central registry notifies the losing registrar of the imminent move, to give them a chance to block it should there be unresolved billing issues or other disputes. Only in such a case was the losing registrar meant to block the transfer.
- If the losing registrar does not object, the transfer is executed.
(Steps 2 and 4 actually run in parallel, but that's irrelevant.)The Problem
However, a number of losing registrars put in a policy some time ago that they would also seek confirmation from the domain owner, despite the gaining registrar having already done so in step 2. They would object to all transfers unless they received authorisation to their liking from the domain owner.
One registrar in particular required a copy of an Australian driving licence or passport, or a notarised letter for non-aussies. In this case it made the administrative cost of a transfer prohibitively high. The did not require this level of identification when a domain was being transferred to them. (Before you ask, yes the admin details were correct. They were just being berks.)
Invariably this policy was put in by registrars to try to prevent customers moving to other registrars, by adding additional hoops. The 'excuse' put forward was to reduce exposure to legal actions.
When one tries to cover ones ass too much, one's hands end up covered in shit.
Not all registrars did this - the nicer ones honored the word of the gaining registrar and only interfered if there were billing issues etc.
The Solution
The new ICANN rules is a compromise - it now explicitly allows the losing registrar to seek the double confirmation, but they can no longer block the move just because the customer didn't jump through enough hoops for them
It does not require the losing registrar to do so, so this is business as usual for the nice registrars.
The important point is that the gaining registrar still has to verify the transfer in the first place, as it should be. The customer confirms their identity once, and no more.
What's to stop a registrar faking authorisation? The loss of their ICANN accredidation, and hence their business.
Final point: although this is a non-story, it *is* important to make sure your admin details, especially your email address, are correct and up to date. Just as you would check your entry in the phone book, check your whois data too.
Security Risks from Bogus Whois Problem Reports (Score:5, Informative)
(a post of mine reposted from ICANNWatch http://www.icannwatch.org/ [icannwatch.org] - slashdot.org rejected it, but I'm used to that LOL!)
-----
Bogus "Whois Problem Reports" are increasingly going from being an annoyance to being a real security risk. Some recent incidents I've experienced due to Whois Problem Reports *merely* being filed:
* Dotster, about two weeks ago, threatened to delete a domain if I didn't respond.
* BulkRegister, just yesterday, threatened to suspend a domain if I didn't respond within 5 calendar days.
What good are Whois Problem Reports when anyone can file one and there is virtually no screening performed to ensure such reports have any validitity to them; reports filed on some of my domains claimed everything was wrong, including the expiration date - what!? Talk about pure nonsense!
As of now, if one wants to cause a registrant problems, all they need to do is file bogus reports at the Internic link below (it's so easy, it's frightening!) - heck, if someone really wanted to be deviant, they could spread a virus that sends bogus Whois Problem Reports from hijacked computers...
http://wdprs.internic.net/ [internic.net]
In addition, some registrars, such as GoDaddy, charge a fee to the registrant for *merely* reviewing a Whois Problem Report for a particular domain, regardless of whether the report is valid - see links below for more details:
http://www.dnforum.com/showthread.php?t=67862 [dnforum.com]
http://www.webhostingtalk.com/showthread.php?s=&t
There is much talk about the transfer policy changes and security, yet bogus Whois Problem Reports is a security risk many times worse.
Some ICANN policy changes are needed pronto regarding Whois Problem Reports...
1. Requiring more than just a name and email for people making complaints - they should have to provide a postal address that's verifyable and/or some other information.
2. Screening of such reports - permit registrars, if they're not already, to toss out Whois Problem Reports that they feel are invalid without involving the registrant; stop wasting their time over this nonsense.
3. A standard on how registrars handle Whois Problem Reports
* including a reasonable time for the registrant to respond, such as 30 calendar days, before any action is taken
Something needs to be done before bogus Whois Problem Reports get any further out of hand
Ron Bennett
Re:Security Risks from Bogus Whois Problem Reports (Score:5, Interesting)
Registrar-Lock (domain "locking") offers ZERO protection in regards to one's domain possibly being suspended / deleted due to a "Whois Problem Report" merely being filed.
Parent
Slashdot sensationalism again (Score:4, Informative)
Stupid rule if you ask me. All this does is put more pressure on Registrars to respond to frivolous requests by other (unethical) registrars phishing for business.
Where does it say this? (Score:3, Interesting)
I do find language that states the transfer will be approved if the Registrar of Record does not respond within 5 days. This, however, is a Good Thing, as it makes it harder for the losing registrar to prevent you from transfering your domain. Of course, they can still just deny your request and hope they get away with it.
The way I see it, this gives domain owners (a little) more control over their domains. I don't see what's wrong with that. I never understood why transfers need to be approved by the losing registrar anyway - why would they ever approve losing a customer?
Re:Where does it say this? (Score:3, Informative)
Dumbest thing I heard since the election ... (Score:3, Insightful)
First, the current registrar must approve a transfer of domain without obtaining the registrant's approval. This is contrary to common sense. If the purpose is to stop registrars from unreasonably holding domain names, then the appropriate response is to require the current registrar to approve a transfer request when the registrant has approved it. If the registrant approves, and the current registrar rejects, that's an appropriate cause for complaint.
After all, isn't it more important to protect existing domains from unscrupulous transfers, than to prevent rogue registrars from accepting legitimate transfers? I may have one legitimate reason to move my domain from one registrar to another but there are a large number of scammers who would gladly capture my domain for fraud or other purposes.
It's a bit ridiculous that every registrar should be forced to implement a locking function, and every domain holder should be forced to lock every domain, all at once, in order to protect themselves from fraud.
Secondly, the "unlock" action required prior to a legitimate transfer opens a window of time in which a domain can be stolen - in programming parlance, a race condition. It's a problem with the protocol.
Just the other day I transferred several domains from Joker to GoDaddy. Joker isn't very easy to deal with, and GoDaddy is cheaper, so I decided to move the Joker ones to GoDaddy.
When I jumped through the Joker hoops to tell them that I wanted to transfer my domain name, they opened a "transfer window". I was shocked when they said that, during the transfer window, _any_ registrar could grab my domain. Not just GoDaddy. Not just me. Any user of any other registrar could have issued a transfer request for my domain name, through their registrar to Joker, and Joker would have accepted it, if the request arrived before my legitimate request from GoDaddy. Indeed, any user of GoDaddy could have done the same thing, because there's nothing in the request itself to say that it was me who instigated that request.
What happened to the good old days when a request for a transfer resulted in an email from my registrar to me, asking for my approval. If I approve, the transfer will go through. If I'm not there or indisposed, overseas or not reading my email, then the transfer will not happen.
I guess the solution is obvious.... (Score:3, Funny)
If there are enough of them, then there got to be at least one which isn't answered within the 5 day timeout.
And whoever wins, wins control of the Internet! Whoot!
Get emailing, theres no bigger competition than this!
Only on slashdot... (Score:3, Funny)
Re:Small domains? (Score:3, Informative)
Re:Small domains? (Score:5, Funny)
OK, you missed my penis joke.
I did too, until I returned with a small reading light and a magnifying glass.
Parent
Re:microsoft (Score:5, Funny)
I would recommend having your lawyers ready...
12 billion in lawyers is a good start...
Parent
Re:5 days? (Score:4, Interesting)
I don't think for a minute that they haven't considered this - it looks like a deliberate move against people who don't want to tell the world who they are. ICANN would love to force these people to list their details.
Parent