Hacker News Reader

Comment by signed0 | Hacker News Reader

Are there any registrars that allow one to set serverDeleteProhibited, serverTransferProhibited, and serverUpdateProhibited?

View on HN

Probably $$$$, but ....

http://reports.internic.net/cgi/whois?whois_nic=microsoft.co...

  Domain Name: MICROSOFT.COM
   Registrar: MARKMONITOR INC.
   Whois Server: whois.markmonitor.com
   Referral URL: http://www.markmonitor.com
   Name Server: NS1.MSFT.NET
   Name Server: NS2.MSFT.NET
   Name Server: NS3.MSFT.NET
   Name Server: NS4.MSFT.NET
   Name Server: NS5.MSFT.NET
   Status: clientDeleteProhibited
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Status: serverDeleteProhibited
   Status: serverTransferProhibited
   Status: serverUpdateProhibited
   Updated Date: 09-aug-2011
   Creation Date: 02-may-1991
   Expiration Date: 03-may-2021

I'm not sure it would have helped in this instance. If the attacker got access to the administrative interface for the registrar, all he'd have to do is unset the relevant flag first, using the same interface, before changing the name server records.

These flags are the functional equivalent of forcing you to break a piece of glass before pushing the fire alarm button.

Some registrars require you to send in a hardcopy request, along various forms of ID, in order to clear these flags. I know mine (PairNIC) does.

It's not unspoofable, but it is an time consuming extra step that involves a human on the receiving end.

Edit: I was thinking of the client(Update|Transfer|Delete)Prohibited flags, which is a registrar lock. I'm not even sure how one goes about setting the "server" version of those flags for a registry lock, but it's probably even more complicated.

And someone reviews that hard copy and flips a switch in an admin interface like the one that supposedly got hacked?

Probably sends out a call to verify first.

I think most of them do, contrary to the article. I have to deal with this all the time.

DomainPeople does have the feature. It is also the registrar for Gate.com and Hostway.

Hmm, I was unable to do so on Namecheap or Gandi.

Yes. CloudFlare has it set that way with Network Solutions.

I believe MelbourneIT do (twitter.com has it set and they are registered there)

Reply on news.ycombinator.com