Hacker News Reader

Comment by OsrsNeedsf2P | Hacker News Reader

> “This was an email address that looked like the real thing,” says Exempt, explaining the mechanics of how he tricked Charter Communications. “The real domain of the Jacksonville Sheriff’s Office in Florida is jaxsheriff.org. We purchased jaxsheriff.us and then spoofed our number as the department’s, so that when we called them to verify receipt of the legal process, when they searched the number, it would come back to the sheriff’s office, giving them no reason to doubt it. We use real badge numbers and officer names as well.”

I'm honestly impressed. It's an interesting situation where the companies can only verify the same information that the hackers have access to

View on HN

"No problem, Deputy Smith. I'll call you back at your listed number now to complete your request."

What am I missing? Not doing this is negligent. Same advice we'd give to phishing targets.

Their listed number on jaxsheriff.us? What if they bought Google ads to get the first result for Jacksonville Office?

> The real domain of the Jacksonville Sheriff’s Office in Florida is jaxsheriff.org. We purchased jaxsheriff.us

This would not be an issue if RFC 1480 had been taken seriously.

Too many edge cases, some would still be exploitable. Eg if the real address was:

    Sheriff.CI.Jacksonville.FL.US

Malicious actors could register:

    Sheriff.Jacksonville.FL.US

Unless your solution is to add some verification step as part of .us registrations.

Many top-level TLDs have requirements you need to fulfill, .edu is a good example. Similarly you need to prove you're a local entity for many country-specific TLDs. At the end of the day though, this attack vector will always be there, no matter how diligent you are about it. Phishing is all about numbers and one in is often all you need.

Can people register a subdomain of fl.us willy-nilly though? Isn't the root domain owned by the state?

From the RFC (note the "or businesses"):

   Name Space Within States:
   ------------------------

   "locality" - cities, counties, parishes, and townships.  Subdomains
   under the "locality" would be like CI.<city>.<state>.US,
   CO.<county>.<state>.US, or businesses. For example:
   Petville.Marvista.CA.US.

   "CI" - This branch is used for city government agencies and is a
   subdomain under the "locality" name (like Los Angeles). For example:
   Fire-Dept.CI.Los-Angeles.CA.US.

So you'd be counting on the sub-registrar of jacksonville.fl.us not to allow a registration for the fraudulent "business" of Sheriff, Inc. -- multiplied by every municipality across the country.

Wouldn't make any difference, you'd just hack one email at any random sheriff department in the country. Or pay $5 for one, anyway.

Reply on news.ycombinator.com