|
|
Security Watch: Squatters Jumping Claims To Domain NamesBy Larry Seltzer7/24/2006 12:30:00 PMThe WatchCan someone steal a domain away just because you checked to see if it was available? It's happening, as we describe in the Whois Hijacking section.Security researchers are hot on XSS (cross-site scripting) attacks and their potential for compromising Web sites. See an example of one in the XSS section.Microsoft's patches this month included one for a scary DHCP vulnerability. It just got a lot scarier, as exploit code was released. See why you should patch now in the DHCP Exploit section.It's a small matter in the big scheme of things, but along with attacks on Israel proper, Israeli Web sites were also targeted this month. Read details of the attack and the lessons it teaches in the Team Evil vs. Israel section.If you have a domain name, you have to keep the contact records up to date. Why? We tell you why in this week's Security Tip.Last week's top threat, a zero-day vulnerability in PowerPoint, yielded a second targeted attack. Find out how serious it is in Security Alerts and Updates.We used lots of domain name jargon in this week's Security Watch, like domain tasting and whois, and we define the terms in this week's Jargon WatchMeanwhile, in other security news, Visa changed the security rules they impose on retailers who use their card services. Read this and more in the Security Watch Story Feed.Whois HijackingHave you ever researched an Internet domain, waited a bit and then, when you go to buy it, it's gone? You may have been a victim of whois hijacking.Through a mechanism not yet well understood, some domain squatters are able to get information on domain lookups, which are performed using a protocol named "whois". They use it to quickly—and automatically—register the domain. This practice is usually combined with domain tasting, so the domains may be available again before too long.In the meantime, the squatters put up an ad page on the site. If it gets hits, they keep the site. They also usually put up a link through which you can buy the site from them (at a vastly higher price than if you had gotten it first).What can you do? Until there is a good understanding of how the whois requests are intercepted, all you can do is to move quickly to register domains once you see they are free. It's likely that some domain-checking services are more secure than others, but there is no reliable way to tell which ones they are.Cross-Site Scripting AttacksSeveral security researchers have been focusing in the last few weeks on "Cross-Site Scripting" vulnerabilities in various Web sites. A Russian research site has just revealed one of many in the PayPal site.Consider this link:This is a link to the PayPal site, and a cursory examination of it, from left to right, will reveal it to be such.But the link includes scripting instructions that redirect the page to a different site, in this case PCMag.com. This attack realizes more malicious potential when it is run in a frameset where the URL continues to display the paypal.com address but the window contains some other site's HTML.Many security tools, including the Netcraft Toolbar, generically identify attacks such as these as cross-site scripting attacks. You can also identify many of them just by being more alert to URL contents and windows.As the Internet Storm Center is reporting, an exploit is publicly available for the recently-revealed vulnerability in Microsoft Windows' DHCP client. We have seen the exploit as well.This specific exploit has only been tested by the authors on Windows 2000 SP4, but the exploit is reported by Microsoft to affect Windows XP as well. It's reasonable to assume that the exploit may be adapted to Windows XP.These attacks are exploitable in the real world, both on business networks and potentially on shared networks such as cable modem networks, where users on a common subnet use DHCP to gain addresses. It is important for all users to apply this update as soon as possible.Team Evil vs. IsraelIn early July 2006, as hostilities flared up between Israel and Palestinians in the Gaza strip, an attack was initiated on servers belonging to Israeli and pro-Israeli organizations by a Moroccan hacking group named "Team Evil."A forensic analysis by Beyond Security's beSIRT team succeeded in disrupting the servers and defacing some of them. The attack shows that best practices are often crucial in protecting critical resources.The major opening for Team Evil was the fact that Internet-facing applications on the servers were not kept up to date with the most recent security patches. This gave the attackers publicly-known avenues for attack.In some cases, applications that were compromised were run with excessive privileges, with the result that other parts of the system were vulnerable.Security Tip: 4 Reasons Why You Should ALWAYS Update Your Domain Name's Contact DetailsThanks to Dave Zan's Domain Name Blog for this tip.Too many people don't keep their domain contact information up to date. Whatever one's problems with the contact information rules—and there are major downsides to having to have contact information public, as ICANN mandates—the information serves an important purpose in keeping you in touch for important communications.
eWeek July 22, 2006 IBM to Sell Tivoli Data Protection Software Online eWeek July 21, 2006 Cisco Patches Security Software Glitch eWeek July 21, 2006 Judge Rejects U.S. Request on Eavesdropping Lawsuit eWeek July 21, 2006 Spyware Fades to a Dull Roar, But Targeted Attacks Loom eWeek July 20, 2006Recent Editions: • Security Watch: Suite Times For Security |
Copyright © 2008 Ziff Davis Enterprise Inc. All Rights Reserved.
http://www.security.ithub.com/article/Security+Watch+Squatters+Jumping+Claims+To+Domain+Names/184158_1.aspx