Forgot your password?
typodupeerror
Networking The Internet

ICANN Loses Control of Its Own Domain Names 61

Posted by Soulskill
from the heal-thyself dept.
NotNormallyNormal writes "CBC picked up an AP story about ICANN recently losing control over two of their domain names on Thursday, June 26. A domain registrar run by the group transferred the domains to someone else. ICANN's press release had this to say: 'As has been widely reported, a number of domain names, including icann.com and iana.com were recently redirected to different DNS servers, allowing a group to provide visitors to those domains with their own website. It would appear the attack was sophisticated, combining both social and technological techniques, but was also limited and focused.' Comcast has had similar troubles lately as well."
This discussion has been archived. No new comments can be posted.

ICANN Loses Control of Its Own Domain Names

Comments Filter:
  • by Calydor (739835) on Saturday July 05, 2008 @05:04AM (#24064773)
    Maybe this'll show them what needs to be changed in the system. Also, err, first post? How?
  • Marina del Rey, CA (July 5, 2008) --

    ENUF. :-( ICANN HAS MY DOMAINS PLZ?

    About ICANN

    The Internet Corporation for Assigned Names and Numbers (ICANN) is a technical coordination body for the Internet. Created in October 1998 by a broad coalition of the Internet's business, technical, academic, and user communities, ICANN is assuming responsibility for a set of technical functions previously performed under U.S. government contract by IANA and other groups.

  • by ShakaUVM (157947) on Saturday July 05, 2008 @05:12AM (#24064795) Homepage Journal

    In a perfect world, this would serve as a wake-up call to ICANN that the current domain name policies are hideously flawed.

    Of course, their heads are so far up their collective asses, though, that they'll just say it was an awesome example of domain tasting by a third party, and all part of the glorious monstrosity they have birthed.

  • HaHa (Score:5, Funny)

    by soundguy (415780) on Saturday July 05, 2008 @05:12AM (#24064797) Homepage

    Ha Ha

    /nelson

  • Sophisticated ? (Score:5, Informative)

    by stephanruby (542433) on Saturday July 05, 2008 @05:21AM (#24064811)
    It's obvious [dnsstuff.com] they didn't follow their own rules by providing valid whois contact information [icann.org].
    • Re:Sophisticated ? (Score:5, Insightful)

      by Anonymous Coward on Saturday July 05, 2008 @05:42AM (#24064857)

      ICANN, as far as I can tell, does not follow rules. Their one and only purposes seems to be to enrich the members of its board. As a result, we have a stagnant generic TLD system with new proposals, etc being designed to extract cash for them rather than benefit the world. I have no problem with them getting hacked -- throws a spotlight on their arrogance and corruption.

      ICANN'T do anything to help the world because I am too busy getting paid.

    • Re:Sophisticated ? (Score:4, Insightful)

      by kimba (12893) on Saturday July 05, 2008 @07:24AM (#24065071)

      Perhaps you can explain what is not valid in the WHOIS information for these domains?

      • by dissy (172727)

        Perhaps you can explain what is not valid in the WHOIS information for these domains?

        Perhaps you could open both links and see for yourself.

        ICANN address from whois record [dnsstuff.com] (on domain):
        Registrant:
        Internet Assigned Numbers Authority
        (IANA) (IANA)
        4676 Admiralty Way, Suite 330
        Marina del Rey, CA 90292 US
        Email: *****@icann.org

        Administrative Co

        • Kimba, Thanks for the backup, but this isn't what I was talking about. I wish I had taken a screenshot of it. When I did that same exact whois search, the information was completely different. It returned correctly, but it contained the organization's name and nothing else.

          I would consider this whois info you just posted valid information (as far as I'm aware). I don't think an organization should be faulted for having multiple addresses -- many organizations do have multiple addresses. Also, according to

  • by Ron Bennett (14590) on Saturday July 05, 2008 @05:36AM (#24064841) Homepage

    When I first read this news several days ago, I thought it was referring to the root servers ...

    What most don't know is that the TLDs (ie. com, .net, etc) themselves are registered in much the same manner as 2nd level domains are ... see the TLD Whois: http://whois.iana.org/ [iana.org]

    The major TLDs (.com, .net, etc) are relatively safe, since any changes would likely be difficult to get through - with any changes quickly noticed ... as in within minutes, or even seconds; likely wouldn't even be that effective, since the most popular TLDs zone dns entries are heavily cached.

    However, ccTLDs are a different story completely, since ccTLD zone name server changes are more common and thus such change requests would be far less scrutinized.

    I've never heard of any TLD being hijacked, but could likely be easily done, since the social engineering involved would be very similar. A frightening prospect.

    Ron

    • Re: (Score:2, Informative)

      by jabley (100482)

      The major TLDs (.com, .net, etc) are relatively safe, since any changes would likely be difficult to get through - with any changes quickly noticed ... as in within minutes, or even seconds; likely wouldn't even be that effective, since the most popular TLDs zone dns entries are heavily cached.

      However, ccTLDs are a different story completely, since ccTLD zone name server changes are more common and thus such change requests would be far less scrutinized.

      I've never heard of any TLD being hijacked, but could likely be easily done, since the social engineering involved would be very similar.

      Changes to TLD nameservers need to pass human inspection at the IANA, human inspection at the US Department of Commerce, and human inspection at Verisign (who provide maintenance for the root zone). This is in stark contrast to the largely mechanical process by which domains in gTLD and ccTLD registries are modified.

      Requests to change entire NS sets (as opposed to simply dropping a couple and adding a couple of other nameservers) are typically stalled early in the process while the IANA requests justificati

  • URL (Score:5, Funny)

    by thedrx (1139811) on Saturday July 05, 2008 @05:46AM (#24064863)
    http://www.cbc.ca/technology/story/2008/07/04/icann-pwned.html

    Anyone else think the URL is hilarious?
    • Re: (Score:2, Funny)

      by Hatkirby (1315373)
      It is! Very strange.... Now, you need to ask yourself, Did they pick that out themselves or did Wordpress (or whatever) generate it for them? *giggle*
  • by jibjibjib (889679) on Saturday July 05, 2008 @07:47AM (#24065143) Journal
    Why do registrars even have to exist? And why does ICANN need to pay other companies to run the actual DNS infrastructure? If ICANN ran .com, .org and .net itself, and there were no registrars/resellers, and every time someone paid for a domain all the money went straight to ICANN, surely ICANN would have enough money to run all the DNS infrastructure itself very well. Then we wouldn't have to deal with all the dodgy things that registries and registrars do, like Verisign's "Site Finder", and various slightly evil registrars stealing domains, and various registrars being incredibly insecure and transferring domains to hackers without proper authentication.
    • Why re-invent fire? If someone in the industry already knows how and provides the service for a fee you're willing to pay because it's much less than what it would cost you to learn, secure, and implement properly, then why do it again, pay more for it, and not sleep well at night? Let the other guy lose sleep.
    • Re: (Score:2, Insightful)

      by tokul (682258)

      ICANN would have enough money to run all the DNS infrastructure itself very well.

      They will have less money, if they have to support the DNS infrastructure.

    • by kvezach (1199717) on Saturday July 05, 2008 @10:09AM (#24065677)
      If they did that, it'd be Network Solutions all over again. Remember their exorbitant monopoly prices when they were the only shop in town? Like that.
      • by Fred_A (10934)

        If they did that, it'd be Network Solutions all over again. Remember their exorbitant monopoly prices when they were the only shop in town? Like that.

        Actually I remember when there was only one shop in town and it was free.

  • No problem! (Score:4, Funny)

    by Veggiesama (1203068) on Saturday July 05, 2008 @08:31AM (#24065247)

    They had no problem getting the domains back. They just kept saying to themselves, "I think ICANN! I think ICANN!"

  • well, Without them There wouldn't be an internet, for one.

    After reading their news release, this goes from "whoo 31337 h4x0r5 shr R Sm4r7" to disgruntaled soon to be ex employee getting he and and all his friends 12 year domains for free for as long as the DNS record is changed. It was an inside job by someone who had access to the Registrar's internal network.

    Whoever made the change knew the system and how ICANN and IANA work, and also knew that ICANN can not really say 'well if you got your domain durin

  • by Conficio (832978) on Saturday July 05, 2008 @09:48AM (#24065543) Homepage

    Hmm, in the CBC article is says "Visitors to those addresses are normally redirected automatically to the organization's main sites at ICANN.org and IANA.org, neither of which was affected by the attack."

    What is to *re*direct here? DNS is there to translate domain names into IP addresses. It does not have any *re*direction mechanisms. Redirection is a feature of the HTTP protocol and would require to compromise the web-server (which they state has not happened.)

    I wonder, Is this simply a typo or does the journalist/editor not understand what (s)he is writing about (and has no references to have this proof read)?

    I'm rather vary, because I see such factual errors often in widely read media, written and edited by journalists. Sometimes I see even "experts" quoted with wrong statements. How does this reflect on news that I don't know so much about that I can spot the factual errors?

    • Re: (Score:3, Insightful)

      Being directed and being redirected are REALLY subtle differences in the mind of a techno-plebe. And no, in Canada, there is no requirement for journalists to hold CS degrees.

      So, when something's directed to one place, and then directed to another place, it's not strange for a reporter to assume that it was redirected, as opposed to newly directed.

      • by Conficio (832978)

        Well, I would like to hold professional journalists to higher standards.

        While I agree that it is a subtle difference, it is a difference I expect a professional word smith (journalist) to pick up and to question its meaning. No degree in CS required, but a critical mind and some sense for the kind of spin that press releases contain.

        And I expect for a reporter to report facts and question them and not "for a reporter to assume." If (s)he simply wants to reprint the press release that is fine with me, but te

    • Re: (Score:2, Insightful)

      by Conficio (832978)

      Not to talk to myself, but I just also read the "press release" from ICANN. It says the same things "icann.com and iana.com were recently redirected to different DNS servers." How can that be?

      The press release also talks about "The domains in question are used only as mirrors for ICANN and IANA's main websites." Well, as of today the domains and the www.... simply point to the same web IP address, which is presumably served by the same server. In my book this is hardly a mirror, which would imply it is some

      • by Conficio (832978)

        Just to continue talking to myself.

        The web server does not seem to be configured well either. If a webmaster cares about search engine visibility (optimization) then (s)he wants to really redirect the aliases for that server to a single normalized domain name. This is not the case with this web server, it responds under http://www.icann.com/ [icann.com], http://icann.com/ [icann.com], http://icann.org/ [icann.org], http://www.icann.org/ [icann.org] and even http://208.77.188.103/ [208.77.188.103]

        This leads to duplicate content in the search engines, makes it harder for r

      • Re: (Score:3, Insightful)

        by Alarash (746254)

        "simply point to the same web IP address, which is presumably served by the same server. In my book this is hardly a mirror, which would imply it is somewhat fault tolerant."

        Or the IP is, you know, a Virtual IP on server load balancers and they can host the website on one thousand different servers at the same time for all you know?

    • Re: (Score:3, Interesting)

      by Phroggy (441)

      You're being deliberately pedantic. I thought it was perfectly clear exactly what they meant:

      Normally, A records for icann.com, www.icann.com, iana.com, www.iana.com and similar FQDNs point to IP addresses of web servers that are configured to send an HTTP redirect (via the Location header) that tells the browser to request e.g. http://www.icann.org/ [icann.org] if http://www.icann.com/ [icann.com] had been originally requested.

      While more technically specific, this takes a lot more words to say than "Visitors to those addresses a

      • by Conficio (832978)

        Well, may be we need to be that pedantic. My read on what ICANN's press release says is the exact opposite.

        The press release says clearly that the http server was not compromised ("The organizations' actual websites at icann.org and iana.org were unaffected. "), but instead the DNS records at the root server were directed to a different DNS server ("The DNS redirect was a result of an attack on ICANN's registrar's systems.") who did reply with different IP addresses that did not belong to ICANN and served a

        • by Phroggy (441)

          I'm confused as to what you're confused about. Somebody got icann.com and iana.com to point to different DNS servers which served A records pointing to third-party IP addresses, so that queries for http://www.icann.com/ [icann.com] and http://www.iana.com/ [iana.com] went to a third-party HTTP server which did not return a redirect to ICANN's official web sites (like ICANN's HTTP server would have), but instead returned something else.

          I didn't bother to read the article (I'm not new here), but what about this is unclear to you?

  • Talk about a bunch of completely incapable morons ... and we're depending on THEM to keep the Internet running?

    Sheesh .. I hope it happens every damned day. In fact I hope someone brings the whole damned thing down. Maybe then the Powers That Be (whoever / whatever THAT is) will replace ICANN top to bottom, clean up the entire domain mess, and give us an honest system.

  • I noted a similar incident a long time ago, as I pointed out once in this message [ietf.org] which was nothing more than one organization filing for the domain name of another, (Sprint registering for the name "MCI.NET") but rather humorous in the result.
  • I submitted the Wired story of this with the headline 'ICANN gets pwned' over a week ago from a journal entry, oh well...!

Life's the same, except for the shoes. - The Cars

Working...