Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: NSI's registrar db hacked

  • From: Steve Gibbard
  • Date: Thu Apr 13 16:11:01 2000

I modified my NSI contact handle last week.  I sent in the modification
template from an address other than what was listed on the contact record,
expecting to get something sent to the listed address asking me to ack the
change, but instead the change just went right through.  The mail from
authentication was never very secure, as it would accept whatever was on
the From: line as suitable authentication, but this seemed even worse than
usual.

I can't say this domain hijacking surprises me much.

-Steve

On Thu, 13 Apr 2000, Rodney Joffe wrote:

> 
> Looks like another hole in the NSI registrar (not registry) system has
> been found and exploited. Apparently some 2,000 domains have been
> hijacked, so if something weird has happened to a domain of yours, this
> may explain it...
> 
> Whois lucasfilm.com
> 
> Query:     indianajones.com
> Registry:  whois.networksolutions.com
> Results:
> 
> 
> Registrant:
> Lucasfilm Ltd (INDIANAJONES5-DOM)
>    senojanaidn 12
>    Tirana, Albania 10000
>    AL
> 
>    Domain Name: INDIANAJONES.COM
> 
>    Administrative Contact, Technical Contact, Zone Contact, Billing
> Contact:
>       indianajones, inetn  (IIO27)  justdoit@MEGAPOST.NET
>       indianajonesorgni
>       senojanaidn 12
>       Tirana, Albania 10000
>       AL
>       323432444 (FAX) 323432431
> 
>    Record last updated on 10-Apr-2000.
>    Record expires on 02-Oct-2000.
>    Record created on 01-Oct-1997.
>    Database last updated on 12-Apr-2000 04:49:41 EDT.
> 
>    Domain servers in listed order:
> 
>    NS1.WEBPROVIDER.COM		209.143.154.70
>    NS2.WEBPROVIDER.COM		207.226.255.71
> 
> 
> Results brought to you by the GeekTools WHOIS Proxy v3.0
> Server results may be copyrighted and are used with permission.
> Your host (204.74.78.193) has visited 2 times today.
> 
> 
> Story appears at http://filmforce.ign.com/news/781.html
> 
> pointer provided by jra :-)
> 
> The url does take you to the lucasfim website now, but earlier it took
> you to Webprovider.com. The above story has a screencapture of the way
> it looked.
> 
> -- 
> Rodney Joffe
> CenterGate Research Group, LLC.
> http://www.centergate.com
> "Technology so advanced, even we don't understand it!"(SM)
> 
> 

--
Steve Gibbard
WWNet System Administration
+1 734 513-7707 x 2009
http://www.wwnet.net






Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.