How I hijacked the top-level domain of a sovereign state | Hacker News Reader

How I hijacked the top-level domain of a sovereign state

labs.detectify.com

295 pointsBerg0X0062 comments

The most ethical move would have been to write to people listed at https://www.iana.org/domains/root/db/cd.html and put IANA in copy (likely ROOT-MGMT@IANA.ORG as listed in the public document: 24x7 Emergency Process Step-by-Step Description).

Quoting the article:

>On January 7th, I reached out to the Administrative and Technical contacts listed for .cd on [https://www.iana.org/domains/root/db/cd.html].

A week after he registered the domain name. That's not the same thing as "before," which I believe the top comment in this thread was implying about what he should have done instead of what he did do.

Yes I spotted that “week” too.

Seems odd to wait a week to make contact if this was purely a white-hat exercise.

I assume you mean that he should have done that when he noticed the domain was pending renewal? (edited to "renewal", not deletion)

He definitely acted decently overall (and did reach out to the people you mention afterwards). But I can empathize with the author for simply thinking "pending renewal? alright whatever" and later on "pending DELETE? shit I should make sure they're OK!".

I guess there's always what's best in hindsight and what's actually done.

That would be the most ethical, sure. But this was a faster and safer course of action. And it wasn’t unethical.

I feel it's problematic that whenever someone writes about an ethically tricky security vulnerability disclosure someone will come up with some variant of "but doing it a bit differently would've been more ethical".

The reason I think this is problematic is that there are already more than enough people in the security community who will either say "fuck it, I'm not gonna bother with that" or "let's sell it to the highest bidder".

We should appreciate more when people are trying to do the right thing and worry more about the people doing clearly the wrong thing and less about whether the people doing overall the right thing did it perfectly.

I think this situation is like knowing a car crash is about to happen and then still waiting for it to happen though. Why not email someone to pay their bill?

It's worse than that. It's knowing a car crash will happen, wait until it does, and then writing a self promotional article about how awesome you are at predicting car crashes in an attempt to sell your car crash prediction services.

And if he wasn't going to contact anyone, watching for the domain name to drop, and manually registering it at that point, is a recipe for disaster. It may not have been feasible for him to set up an automatic registration script (although I see he was using Route 53, so maybe it would have been?), but being first in line to drop-catch a domain name is the exact purpose of services such as SnapNames. Took a terrible and unnecessary risk on top of not doing the "most ethical" thing.

> Although one of the contacts replied and delegated to their colleague, as of this writing, I haven’t received any follow-up confirmation that they fixed the issue.

Wonder if that means they're investigating a "legal response" to his report?

eg the old "shoot the messenger" approach :/

Many countries would do that, unfortunately

The Democratic Republic of the Congo does not have a lot of muscle to flex on the world stage.

I had a gut feeling it will be '.cd' before clicking on the article and I was right. Dealing with the state entity (SCPT) that manages this TLD is quite a pain. It's so painful that I've given up managing all the .cd domains I used to own.

.cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.

> .cd domains are also some of the most expensive to get. Hopefully the new government will take this seriously.

I bought one a few years ago for 80 Euros / year. Aren't there a lot of TLDs that are way more expensive?

Not too many ccTLDs. AI comes to mind (Anguilla, expensive for obvious reasons), but it’s still cheaper than .CD.

Many gTLDs are expensive due to their target demographics or to dissuade bad actors (eg .auto, .bank).

The new crop of TLDs are really cheap. I bought a .download for like $2 a year or something. Not all are that cheap (I bought it as a throwaway for a project that relied on my having DNS control) but there are literally hundreds of them that are.

Only issue is I don't think there's anything preventing the price going sky-high in coming years, for most of these TLDs. For a throwaway it doesn't matter, but could really hurt if you start relying on one.

Kiribati (.ki) comes to mind - 900€ per year via ghandi.net or 1350€ at eurodns...

According to tld-list.com, the .th TLD is the most expensive ccTLD at $5000 and .ru is the cheapest at $2.99

Top-level .th (Thailand) is very expensive, but .co.th is reasonable ($50/yr).

But you do need to have a registered business in Thailand with the exact name as the domain name to register the domain.That's a fact for co.th, I'm not sure about .th though, but I would assume it to be true.

You can register/renew it for $59, see https://tld-list.com/tld/cd

What’s to stop a TLD seller doubling their price? Is there any regulation against the practice?

There was some discussions here recently about this, and from memory the answer was nothing, except reputation. They're free to do whatever they please with it, though jacking the price suddenly might not be great business long term.

Interesting read and also the reaction from authorities in DRC is interesting - they changed the records with IANA. Probably good course of action because OP could hold them hostage and they shouldn't risk relying on his written confirmation in such a important matter.

Good decision making on the DRC in the end. Well Done.

Shouldn't he have acted when he noticed the soonish expiration instead of hoping to be the only one watching for expiration?

It's not uncommon for organisations to be late with renewing their domains and you probably don't want to send false alarms.

Once it's in the redemption grace period the domain is already on the way to deletion. That's not part of the normal domain lifecycle; that's part of the deletion lifecycle.

This was not a false alarm.

You clearly have never ever worked in domain renewals before. Many people only renew once dns stops resolving. I've seen govt agencies use this as their reminder to renew.

And yes, many scammers out there send postcards to businesses offering to assist for $1,000 on the renewals - and many people pay. So people do send out "alerts" the way you ask - most commonly exploitive and at least I give the advice to ignore ALL such renewal alerts. If you are telling people to respond to those you are sending people down scam ally.

> Many people only renew once dns stops resolving.

DNS stops resolving because the domain is pending deletion. At that point it's not a renewal, it's a restore (which costs a lot more money). Refer to the brown "Domain no longer in zone" section of ICANN's lifecycle chart: http://archive.icann.org/en/registrars/gtld-lifecycle.jpg If people are actually regularly using restores instead of renews then they're unnecessarily throwing away lots of money.

> I've seen govt agencies use this as their reminder to renew.

What TLDs were these government agencies using? gTLDs have uniform policies but ccTLDs and special purpose TLDs like .gov do not (and you cannot generalize your experience there to gTLDs). But the expired nameserver domain registration under discussion in this article is a .com, which is a gTLD, so it goes through the standard lifecycle of 30 day redemption grace period + 5 day pending delete period, and during these its DNS is yanked.

Source: I've been in the domains industry for 7 years and run 44 TLDs.

Then you should absolutely know that pending deletion is not a black swan event. Can you talk to someone with some data in this space? You will find pending deletion -> restore is a surprisingly common pattern.

As to govt agencies - sure, many use .org and .com domains routinely. These do not get special treatment - and I do generalize my experience from .com and .org to these govt run websites without hesitation.

Despite ideas - just because a public agency is using these domains does not make them magic.

https://www.sfcdcp.org/

https://acphd.org/

to pick two domains within 10 seconds.

I'm going to stop here. Despite your claims that folks don't go into pending deletion - they do. I am responding to top comment - people fail to renew their domains on time routinely. I've seen it happen with some surprise in govt agencies (ie, someone in a dept spins up a website, and renews when someone complains its not working and they get permission to spend the money to renew - which is not instantaneous even for small purchases) as well.

All my points stand and I remain unconvinced by your claims that these govt agency websites can't expire (they do routinely), that pending deletion is a black swan event (it is not) or that folks don't fail to renew on a timely basis (they do frequently).

Exactly what I thought. It would have been more ethical to write to them the day BEFORE the expiration (and still buy the domain if they didn't act fast enough).

> If I had operated with malicious intent, I could have also [...]

Wouldn't most of these be mitigated if that ccTLD used DNSSEC (according to dnsviz, it currently doesn't)? The hijacked DNS servers wouldn't be able to provide correctly-signed DNS records, so the fake answers would be rejected by all validating resolvers.

Could this be leveraged to hijack additional TLDs? If any other TLD uses a ".cd" NS, like .cd used a ".com" NS...? (Are there any?)

Yes, although it's hard to imagine any TLD using .cd for NS.

It would also be less effective unless that TLD was using .cd for ALL of it's NS records.

Maybe you could find a cluster of TLDs delegating to each other in a loop. Combined with huge TTLs you might be able to bootstrap a full takeover of a subset of all DNS?

Wow. An entire country can accidentally be hosed if their domain name used by their NS expires? Is it that perilous?

Of course, the moral of the story goes beyond TLDs and for nameserver hostnames in general.

Interesting that it wasn't drop-catched, as .com names tend to be. I suppose it didn't have any metrics that'd qualify it for automatic registration.

Not even for 'domain tasting', though I guess it depends on drop catchers setups, which I imagine is just interested in any traffic on port 80/443.

The TL;DR: he registered one of the expired domains that manage the TLD namespace of Democratic Republic of Congo.

It pisses me off that for something of this magnitude this guy will probably only be paid no more than a couple thousand dollars, if at all. He still has no response.

This was good work.

The DRC has a lot of problems (to say the least) at the moment and has had for a while and this is pretty low priority in their scheme of things. Countries with weird residual TLDs for non-sovereign territory (e.g. .as or .ac) surely pay more attention to these trivial domains than anyone in the DRC can.

Which is all to say the amount of effort expended on any task, or the amount of knowledge brought to bear on a task, is only sometimes correlated with its value. Ever worked hard on a company that failed?

I felt I needed to put the first line in because my comment on your question could have been misinterpreted as criticism of the hacker.

DR Congo is one of the poorest countries in the world. GDP/cap is $457 a year. If he does get a few thousand that is more than one worker earns in 10 years. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...

Understandable stance, but the damage he was capable of causing was probably millions of dollars worth. So yeah, a few thousand bucks as a thank you is reasonable.

> the damage he was capable of causing was probably millions of dollars

That applies to most of us.

It also doesn’t change the fact that there is very little money available in the DRC.

What on earth does that have to do with anything here? I probably make more as a software developer than some Americans make in 10 years.

If rich countries and private charities were serious about foreign aid, they'd consider helping fund things like this.

Paying developers outside the DRC? I’d imagine that most who wanted to help would prefer something more direct.

I work for a few a cities in Europe, and happen to know one of the cities had a site with an sql injection issue. An external person found and let the city know but didn't want to reveal the specifics before getting money. The city has no bounty program and for some people in the City it came across as if the guy was distorting them. The guy probably felt like he didn't get money for his work. Probably both have a point. In the end it got resolved.

The guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.

What are their damages? He's not required to disclose their security vulnerabilities to them. It's his work not theirs.

I think lovasoa is pointing out what could happen in real-life, not 'what should happen morally/ethically/etc'.

if he was smart, then he said nothing that sounds like blackmail. but you could say, for example, that I have to settle the expense of reproducing it and writing it down properly or something similar.

sue him for what? Discovering an exploit without disclosing the details?

It depends on the country, but in France for instance, there is a maximum sentence of one year in prison and a 15000€ fine just for "fraudulently accessing a data processing system", or trying to do so even if you don't succeed.

And they'll prove that without knowing what the exploit is?

  s/distort/extort/

Yes right. Apologies.

It may not directly pay but his reputation as Security Expert is enhanced.

I don't know if "Big Internet" (ICANN, IANA, IETF, RIRs) does not have its own security group like the Commercial companies do (Project Zero, various EH companies). RFC3013???

We have to depend on people who can take time to look for exploits in exchange for reputation.

Getting paid in exposure is not getting paid.

It seems more likely that the OP even lost money buying a useless domain name that no one will pay for. Most probably not even a "Thank You" they will give.

Why should he get anything at all? Does every "ethical hacker" need to hold his hand out for a reward? (Doesn't seem as ethical, then, does it?)

Reply on news.ycombinator.com