One thing I didn't realize until after this was posted was that the wiretaps ISPs will be ordered to perform under C-2 are warrantless. Just ministry orders.
The Gell-Mann Amnesia is strong in this story and thead.
As I posted on Krebs' article:
This is neither news nor new. There have been prior panics around this “water is wet” type issue going back at least a decade.
(Search up “Floating Domains – Taking Over 20K DigitalOcean Domains via a Lax Domain Import System” – and others).
I also wrote about this on CircleID from the DNS operator’s perspective (“Nameserver Operators Need the Ability to “Disavow” Domains”) – after this same issue was used to DDoS attack another DNS provider by delegating a domain to their DNS servers without having setup an account there, and then doing a DNS reflection attack on that domain. That was over ten years ago.
The fact that people can delegate their own domains to somebody else’s nameservers without ever properly setting up a zone on those nameservers, or ever keeping track of where THEIR OWN DOMAINS point is 100% the responsibility of the domain owner – and to varying degrees a function of their REGISTRAR – who is the only entity that has any control over it.
It’s a weird flex for corporate registrars who purport to be “high touch” and exclusive, to simply shrug their shoulders and turn a blind eye to their own clients’ obviously broken and vulnerable nameserver delegations.
For our part this is specifically one of things we actively monitor and alert our clients about.
Default behaviour in a registrar transfer is to leave the nameservers as is - the rar has to explicitly send a new ns set in the transfer call to effect a change.
Are you positive you didn't accidentally tick a checkbox or anything to use their nameservers?
I've been monitoring this with an eye toward creating a honeypot for DMARC abuse but so far been seeing zero messages come in.
Either the spammers haven't figured it out yet, or they realize it's a waste of time since all the messages are either mechanically processed or ignored.
reply