Corp.com was (is?) the default example domain in many applications from Microsoft. As a result many badly configured networks are attempting to connect to this domain, often sharing credentials in the process.
He who owns corp.com will have access to tens of thousands of corporate networks. So the only move that MS had was to buy the domain, regardless of the price.
I guess mr O’Connor (who sold the domain) made a nice retirement today.
So if you have your fully-qualified AD domain set to `ad.example.com`, that's the default search domain too, and a DNS lookup for `corp` will first check `corp.ad.example.com` then `corp.example.com` then `corp.com`.
Now, if you're using the AD server as your DNS server then it shouldn't get that far -- `corp.ad.example.com` should resolve. But if for whatever reason a device connected to AD doesn't use the AD server as its DNS server, for example if it's a laptop and not connected to the corporate network, then you'll be offered a _different_ search domain like `myisp.com`. Which probably _won't_ resolve `corp.myisp.com`. So the built-in resolver will after all walk its way up the search domain and check `corp.com` QED.
> Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled.
While it's true that access used "corp.com" as a sample domain, the problem is what Krebs calls "domain DNS devolution"
> Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”
Krebs has written two articles about this that explain the problem.
if O'Connor demanded something ridiculous like 10 billion dollars... how do you talk him down when the situation is this onesided?
https://krebsonsecurity.com/2020/02/dangerous-domain-corp-co...
"O’Connor said Microsoft actually offered to buy the domain several years back for $20,000. He turned them down, saying that at the time he thought it was too low and didn’t reflect the market value of the domain."
Land is nothing but objective and quantifiable qualities like its distance from the city, natural resources, size, fertility.
Domain names are arbitrary. If people want to swap $millions for vanity, I say let them.
The only downside is that well capitalized bidders could harass small owners with outsized bids, if they were willing to possibly end up with ownership.
An actual land value tax would be even better!
Not an auction. There's no indication the owner did anything beyond mentioning the desire to auction it.
It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. If he could, I could understand why he might be reluctant to sell, even if given a strong offer.
But the fact is, if Microsoft walks away from the negotiations, he gets nothing, and there are likely few other buyers he could ethically sell to, and those buyers are unlikely to offer as much as Microsoft can.
He could have sold the domain to someone not concerned with the "legally" part.
They can't seize a domain because you were running some service on it, can they?
Just one example: https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-...
Of course actually doing anything with the received private data might be illegal, but that would be harder to track. How would the owner of a misconfigured network ever figure out how their data got "hacked"; whether the owner of corp.com did something or nothing with it?
Hence ancestor's use of "ethically" rather than "legally".
Human knowledge and intent matters in legal matters. If a technology is accidentally misconfigured to send sensitive data to a third party, and that third party knows that the data they are receiving was not intended for them, then they are still responsible for not willfully misusing that data. That's clearly the case with corp.com.
> If this is illegal, then I can shut down any site by sending my private data to it.
No, if you knowingly choose to send your data somewhere, then you can't turn around and blame the people receiving your data. Again: human knowledge and intent matter for the law.
As an example, a charge of trespassing depends on permission (human knowledge and intent), not whether you leave your gate open (how a system is configured).
The point is that it would be hard-to-impossible to go after someone who owns corp.com even if they use it for nefarious purposes because the actual nefarious action would be so hard to discover or prove.
Besides which, the bad actor here could easily live somewhere without an extradition treaty to the US or simply remain pseudo anonymous (via shell companies, bitcoin, etc). So, it would be possible for an unethical owner of corp.com to find a buyer who intends to use it for ill.
Playing along in that dance is arguably unethical and shows intent.
Anyone that wanted to develop a real business based on a tremendous four letter .com address, which is a vast selection of potential buyers he could ethically sell to.
The name itself, independent of the inbound sensitive stream of data, is worth a lot. Any major enterprise company in the US could trivially develop policies to deal with the inbound sensitive data while using the name for a legitimate business. This one guy has been dealing with it just fine for two decades.
I'm sure someone would get their undies in a twist and sue me, which is why I've never done anything of the sort with the juicy traffic that's come my way (in a similar, though long in the past, situation that shall remain unspecified).
But 1 packet out of 100,000 gets upsidedownternet.
I genuinely wonder how much that matters these days. You've got app stores, Google searches, etc... I think having a memorable, short .com URL was a huge thing in the mid-2000s, but I'm less sure that it is today.
I believe that there was no agreement to be made. O'Connor put the domain up for auction, so MS was bidding against other buyers, not O'Connor.
> But the fact is, if Microsoft walks away from the negotiations, he gets nothing
I expect that the domain still would have sold, although not for price that MS now has paid.
Regardless of who O'Connor would have sold to it would have been a nice payday and he knew that. It was just a matter of waiting for the right moment to put the domain up for auction.
There are circumstances where I would consider it ethical. For example, publishing the logs after a month (or whatever) delay and after notifying the relevant parties to fix their configs and change any secure information exposed.
In that case, it's similar to security researchers releasing the information, and I imagine it also protects him from liability in some ways. Firstly, he treats all traffic the same and has a public policy of exposing it, I think that more clearly puts the problem on the people sending the data to a public location, and secondly, people at a company that are looking at a security problem won't notice some some info went out to him and grasping at straws look to cover their own asses by trying to say that's where the problem must have come from.
The original article said he was trying to auction it starting at $1.7M. There's no indication that an auction ever took place, however. It also sounds like the owner wanted Microsoft to buy it and was willing to work with them, and ultimately this is what happened. My guess is that it went for well under $1.7M.
"Ugh, I can't believe he made money by acquiring a large pile of Apple stock for $1 each back in the 90's, squatting on it, then slowly selling it at extortionate (read: market) prices a few decades later. He's done this many times before and already retired because of these payouts. I'm not happy to hear he got a single cent."
Second, when you invest you are offering financial value. He just contacted someone, said "hey can I have these domains please?" and did nothing with them for 25+ years, until he was finally able to demand a payout. again.
are all the people who tried to sell their hoarded toilet paper people who "identified something of value early on before anyone else did"?
Web domains function in a thousand different ways, and in some cases a medium of exchange metaphor may work (e.g. people want the domain to make more money). In this case, it's more akin to hoarding hand sanitizer and toilet paper until people have to pay scalper's rates out of fear of repercussion. The only reason this is a story is because of the security risks it presents, and holding that risk hostage is pretty obviously unsociable behavior (even if it is Microsoft's dime).
Not really, right, Microsoft could go back and fix this another way. They could release patches to all the major OS versions that had this bug, and push their customers to upgrade or face security issues at their own peril. I'd have to imagine all the customers with this problem have long-term support contracts, and if they don't, well, I don't know what to tell you.
What he's providing Microsoft is a dramatically cheaper, easier way out of a problem they made for themselves with poor/buggy domain resolution. He didn't create the bug. He's selling them a patch that costs a fraction of a fraction of what they'd have to pay to get themselves out of their own mess.
Think of it more as someone who acquired a tow truck as an inheritance, and sees an armored car in the ditch. The armored car could get themselves out, they could remove their gold bricks one piece at a time, then pull the car out and load the bricks back on. Or, they could give a brick to this guy and call it a day.
He didn't push them in, he's offering them a much more cost effective way out.
You may not like it, but this is capitalism.
The other aspect is thinking about which activity is actually economically productive. In the case on investing in Apple, you're producing value, since Apple wouldn't otherwise been able to exist without the capital. In the case of domains, me buying a domain in 1990 is completely unproductive (the domain is still "there" regardless if I buy it or not). I don't see the value to society in rewarding people for rent-seeking on monopoly goods, while the value in encouraging capital investment is clear.
Capitalism doesn't require this sort of rent-seeking, and Adam Smith (as well as other thinkers) identified (and formulated solutions) this problem in the case of land, which is similar.
When you purchase stock at an IPO, you're providing value because you're giving a company funds which they can use to build their business. Later buyers of the stock are providing value because they're incentivizing the buyer at IPO. All further purchases of the stock flow out of that.
When you purchase a domain, you're taking a valuable, limited resource, and paying, typically, a pittance for it. You're not providing value, period, at all. Ostensibly the reason we let people do this is that they will use the domain to provide value in the form of a website that people use.
So stock buyers are providing value to the market, while domain squatters are actively removing value from the market.
They're not limited, the short ones are. I'm not sure why people think they're entitled to short domain names.
> You're not providing value, period, at all.
I mean, you pay an annual maintenance fee do you not? That funds the registrar, which funds ICANN.
> So stock buyers are providing value to the market, while domain squatters are actively removing value from the market.
Maybe squatting on a domain provides them some satisfaction, who are you to judge how people choose to use their domains? If I choose to host pics of cats on "cats.com" (as the current squatter is doing) am I any less entitled to the domain than PetSmart? Just because you don't approve of what I choose to do with it?
Yes domains aren't specifically fungible, they're slightly different with regards to how memorable they are. You can still do exactly the same with each of them: host a website.
Sounds like there's more market oriented ways to resolve this issue. If you feel like short domains provide the world outsized value, why charge the same $10 annual maintenance fee as a 15-letter domain? The shorter, the higher the registration fee. Problem solved?
An often overlooked complication as well comes in the form of programming language package management reliant on reverseddomain names. Fail to renew your domain claim, and you may find yourself having to repackage healthy chunks of code.
The vast majority of squatted domains aren't squatted by "the little guy", so nothing you say starting from that incorrect assumption has any validity.
I'd argue that domain names are limited: there is exactly one of each domain name, the fact that there is a practically infinite number of other different domain names isn't necessarily relevant.
Yes.
It's not as obvious with something like cats.com how this harms society, but I've worked with nonprofits numerous times who had to pay tens of thousands of dollars for their domain names because someone squatted them.
Let's not pretend there aren't widely-agreed-upon values being trampled here. Your argument is moral relativism.
> Sounds like there's more market oriented ways to resolve this issue. If you feel like short domains provide the world outsized value, why charge the same $10 annual maintenance fee as a 15-letter domain? The shorter, the higher the registration fee. Problem solved?
Given you haven't even agreed that there is a problem, it's pretty clear you just want to propose a market-oriented solution regardless of what the problem is, or whether the market can even solve it. This is not how problems get solved.
Another poster used the stocks analogy but I think the real estate one is more appropriate. Someone who bought land a long time ago that is now desirable to another party can has no obligation to sell at all (let's not bring eminent domain into this). Let's say instead of corp.com this was land next to Microsoft Campus in Redmond. Why shouldn't someone ask for as much as they can get for their land?
Example: https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp...
Example.com exists for a reason.
How could anyone trust MS for security anything?
This seems like Microsoft in a nutshell, when example.com has been the official standard example since at least 1999.
> Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”