WHOISis a public database that stores all information related to domain name registration and DNS configuration updates. The WHOIS database is regulated by. ICANN, or the International Corporation for Assigned Names and Numbers. It ensures that websites are properly registered in order to keep them safe. (2)<\/p>\n\n\n\n
The WHOIS database stores information in multiple locations, which are administered by various domain registrars. Each domain registrar and registry are in charge of handling certain top-level domains like .com and .net, ensuring that all details are correct and up to date. (2)<\/p>\n\n\n\n
First, the database was designed as a directory, collecting all of the contact information for anyone transmitting data across the ARPANET, a precursor to today\u2019s Internet, and the WHOIS lockup was created to promote transparency in domain registration by ensuring that every domain name has identifying, information, making it easy to check the registrant and identify the website owner. The WHOIS lookup can be used by anyone online and it can help business owners monitor domain availability, investigate potential infringements, and make data-driven decisions. (2)<\/p>\n\n\n\n
The WHOIS database contains important information about a domain, including but not limited to:<\/p>\n\n\n\n
- \n
- Registrant Name \u2013 the person or entity that owns the domain<\/li>\n\n\n\n
- Registrant Contact Information \u2013 when domain was registered<\/li>\n\n\n\n
- Domain Expiration Date \u2013 when registration expires<\/li>\n\n\n\n
- Nameservers \u2013 the DNS information that direct traffic to the right web hosting service<\/li>\n<\/ul>\n\n\n\n
Some registrants utilize services that disguise their information in the WHOIS lookup to protect their privacy. (2)<\/p>\n\n\n\n
The Uncertainty<\/strong><\/h2>\n\n\n\n
His server received from over 76,000 unique IP addresses in hours and 2.5 million inquiries in five days from 135, 000 different systems, including domain registrars, online security providers, governments, academic institutions, and certificate authorities. According to the research, governments and authorities around the world have misplaced trust in the process. The business argues that well-resourced nation-states will find defects in this critical process since they are continuously hunting for gaps. (1)<\/p>\n\n\n\n
Harris removed real.mobi address from his WHOIS database, concentrating on administrative emails address and watchtower.com domains, and added ASCII art for levity, which appears as this:<\/p>\n\n\n\n
![\"\"](\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\")
<\/figure>\n\n\n\nWHOIS information for google.mobi as shown by a rogue server at whois.dotmobiregistry.net Credit: watchTowr<\/p>\n\n\n\n
However, the rogue WHOIS server provided Harris enormous access, including the ability to dictate the email address certificate authority that GlobalSign uses to identify domain ownership. Harris received an email from GlobalSign with a verification link for a certificate signing request for Microsoft.mobi. He then called off the project due to ethical concerns.<\/p>\n\n\n\n
<\/figure>\n\n\n\nAn email Harris received from GlobalSign after generating a certificate signing request for microsoft.mobi. Credit: watchTowr<\/p>\n\n\n\n
Therefore, the ability to issue a TLS\/SSL certificate for a.mobi domain enables a variety of criminal operations, such as traffic interception and spoofing the target server, rendering threat models outdated.\u00a0(1)
<\/p>\n\n\n\nOther WHOIS server Exploit<\/strong><\/h2>\n\n\n\n
The rogue WHOIS server can be used for a variety of malicious objectives, including getting forged certificates, tracing emails chains, and exploiting weaknesses in WHOIS clients and security services. This enables him to passively infer communication partners and exploit vulnerabilities that are usually only available to trusted WHOIS servers. As a result, the rogue server has been investigated by a number of third-party sites and services, including Google\u2019s VirusTotal, URLScan, domain registrars, and WHOIS websites. WatchTowr collaborated with the National Counterintelligence and Secuirty Centre and ShadowServer to protect the dotmobiregistry.net domain. (1)<\/p>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
It is quite concerning that $20 domain purchase has exposed vulnerabilities in communication and subversion of the Certificate Authority verification system, highlighting the need for improved trust and security process for internet users.<\/p>\n\n\n\n
Unfortunately, this will become increasingly common as the internet\u2019s foundation is being neglected, leading to increased vulnerability in critical systems like financial institutions, universities, hospitals, and government websites.<\/p>\n\n\n\n
References:<\/strong><\/p>\n\n\n\n
[1] Rogue WHOIS server gives researcher superpowers no one should ever have. (11.Sep.2024). Retrieved from https:\/\/arstechnica.com\/security\/2024\/09\/rogue-whois-server-gives-researcher-superpowers-no-one-should-ever-have\/
]2] What is WHOIS and How to Look Up a Domain? (n.d). Retrieved from https:\/\/www.domain.com\/ca\/en\/blog\/what-is-whois-and-how-is-it-used\/<\/p>\n","protected":false},"excerpt":{"rendered":"In Brief Benjamin Harris, CEO of watchTowrs, successfully manufacture fake HTTP certificates, tracked email activity, and execute code of his choice on thousands of servers for $20. He registered the domain dotmobregistry.net, which was previously the authoritative WHOIS server for .mobi. He observed the domain\u2019s expiration and set up his own .mobi WHOIS server there, … <\/p>\n
![\"\"](\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2024\/10\/image-20-871x1024.png\"){kind=spacer}
<\/figure>\n\n\n\n![\"\"](\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2024\/10\/image-21.png\")
<\/figure>\n\n\n\n