Re: [FreeDNS] Domain modification completely insecure

[Christiaan Keet <keet@xxxxxxxx>]

On Tue, Jan 13, 2004 at 05:07:21PM +0000, David Grant wrote:
> If you own a za.net or za.org domain please be aware that your domain 
> contact details and nameserver records can be changed at any time by anyone.
> 
> The only "security check" that the modification system uses is to check 
> that the email address in the "From:" field of the domain modify email 
> matches the email listed in the domain whois technical contact.
> 
> Seeing as anyone can change the "From:" field of their email, and seeing as 
> no acknowledgement reply is required for the domain modify request, anyone 
> is able to change the domain records for any ZA NiC domain.
> 
> Whether or not this domain registry is free, this level of security is 
> unacceptable. People are registering domains in good faith without the 
> knowledge that your security procedures are entirely inadequate.

We are aware of this issue. Since we've been registering domains
(over 6 years now) we've only had two incidents where this has been
a problem. Both within the last week, which immediately makes me
suspicious.

We are treating both these attempts at "domain hijacking" very
seriously and have already been in contact with the service provider
who the email originated with to ensure the individual is traced
and dealt with. This is of course email fraud, which all reputable
service providers frown on and most have established procedures for
dealing with this and reporting it to the authorities should it be
deemed neccessary.

Having said that, we are currently working on more secure ways of
modifying domain details which we hope to have ready for use soon.

The current system notifies the contact email address on the domain
record of any attempted modification both before the modification
happens and after it has been completed. While we're working on the
new systems we just ask that users notify us as soon as possible
to hostmaster@xxxxxxxxxx if they see any suspicious activity with
their domains.

- Christiaan

-- 
  ZA NiC Hostmaster             http://www.za.net/
  hostmaster@xxxxxxxxxx   Tel/Fax: +44 1442 240870