At 16:48 22/02/2000 +0700, Steven Haryanto wrote:
>> Saat ini banyak berita di detik.com ttg penjarahan domain...
>> bisa kasih pencerahan modus operandi dan cara pengamanannya ?
Domain Hijacking: A step-by-step guide
----------------------------------------------------------------------------
----
SUMMARY
The sole purpose of the information contained in this advisory is to point
out the flaws in InterNIC's domain name handling system and is intended
for educational use only. Since this is public knowledge, it should be
also in everyone's reach.
The technique described below involves an easy to follow procedure of
stealing .com/.net/.org/.gov/.mil domain names.
This vulnerability has been publicly known for quite a while, and there
are ways to prevent it (See below).
The procedure below enables an attacker to take over a domain name,
enabling him or her to make the arbitrary web address (www.example.com)
point to any desired web page on the Internet. This method of domain
hijacking is constantly being used to hijack domain names, and to deface
web sites.
DETAILS
Required ingredients:
* Anonymous remailer or mail bomber that can spoof email addresses.
* Social Engineering skills for timing the emails.
* A fake email address at hotmail.com or any other free service.
Exploit:
As an example for this advisory, we will take the domain name wi2000.org.
Go to <http://www.networksolutions.com> http://www.networksolutions.com
and click on the link that says 'Who Is.' Now enter the domain name
(wi2000.org in this case) in the search field and click on the 'Search'
button. This would show you the WhoIs information as shown below:
Registrant:
WI2000 (WI24-DOM)
Blixered 1
Goteborg, Lila Edet 46394
SE
Domain Name: WI2000.ORG
Administrative Contact:
MICKE, ANDERSSON (AMM367) [EMAIL PROTECTED]
545326-3445 (FAX) 545326-3445
Technical Contact, Zone Contact:
Jason, Berresford (BJE41) [EMAIL PROTECTED]
1-(905)-765-5212
Billing Contact:
MICKE, ANDERSSON (AMM367) [EMAIL PROTECTED]
545326-3445 (FAX) 545326-3445
Record last updated on 22-Jan-2000.
Record created on 19-Dec-1999.
Database last updated on 3-Feb-2000 14:29:53 EST.
Domain servers in listed order:
NS1.CAN-HOST.COM 24.215.1.6
NS2.MOUNTAINCABLE.NET 24.215.0.12
Now you have two choices:
1) Either you could take full control of the domain by changing the
Administrator's handle information.
Or
2) You could simply point the domain to another host and let it recover in
time by itself.
Initiating the First Attack:
Let us first explain the InterNIC authentication system in case most of
you would be the readers who do not have their own domain names. The
problem with InterNIC authentication is that they do NOT send a
confirmation email if the request is sent from the same email as the
person owning the contact or the domain name itself! Therefore, utilizing
this flaw one could spoof anyone's email address and change any domain
name's information.
Although, a confirmation is required from the person to whom the domain is
about to be transferred; and that shouldn't be too hard as it would your
own email address.
Here's a step-by-step procedure:
- Go to <http://www.networksolutions.com/>
http://www.networksolutions.com/
- Click on the link that says 'Make Changes.'
- Enter the domain name wi2000.org
- You should be presented with 2 blue buttons
- Click on the one that says *Expert*
- Next screen would have a heading 'Select the form that meets your
needs'
- Click on the link that say 'Contact Form'
- Next you should see a form with 2 fields.
- In the first field enter the admin's handle (wi2000.org admin is
AMM367)
- In the next field enter his/her email address (in this case it's
[EMAIL PROTECTED])
- Change the option to 'Modify.'
- Now 'Proceed to Contact Information.'
- Select the MAIL-FROM option and click the 'Go on to Contact Data
Information.'
- Now you should see all the information about the admin contact of
domain
name!
- In the E-mail address field change the email to your own fake email.
(in this case it's [EMAIL PROTECTED])
- Now 'Proceed to Set Authorization Scheme.'
- Again choose MAIL-FROM and enter the email address of the admin
([EMAIL PROTECTED])
- Leave the bottom option to 'No' and 'Generate Contact Form.'
- Now you should see a template with all the information. Similar to
this:
******** Please DO NOT REMOVE Version Number ********
Contact Version Number: 1.0
******** Please see attached detailed instructions ********
Authorization
0a. (N)ew (M)odify (D)elete.: Modify
0b. Auth Scheme.............: MAIL-FROM
0c. Auth Info...............:
Contact Information
1a. NIC Handle..............: AMM367
1b. (I)ndividual (R)ole.....: Individual
1c. Name....................: MICKE, ANDERSSON
1d. Organization Name.......: WI2000
1e. Street Address..........: BLIXERED 1
1f. City....................: GOTEBORG
1g. State...................: LILLA EDET
1h. Postal Code.............: 46394
1i. Country.................: SE
1j. Phone Number............: 545326-3445
1k. Fax Number..............: 545326-3445
1l. E-Mailbox...............: [EMAIL PROTECTED]
Notify Information
2a. Notify Updates..........: AFTER-UPDATE
2b. Notify Use..............: AFTER-USE
Authentication
3a. Auth Scheme.............: MAIL-FROM
3b. Auth Info...............: [EMAIL PROTECTED]
3c. Public (Y/N)............: NO
NOTE: Do NOT press the button at the bottom that says 'Mail this contact
form to me!'
Copy and paste this message into your anonymous remailer or mailbomber and
you are ready to go; but WAIT! It's not that easy, now comes the HARD
part! When you mail this message to [EMAIL PROTECTED] a
message similar to the following would be sent to the admin email address:
Subject: [NIC-000128.4r50] Your Mail
______________________________________________________________
This is an automatic reply to acknowledge that your message has been
received by [EMAIL PROTECTED] This acknowledgement is
"NOT" a confirmation that your request has been processed. You will be
notified when it has been completed.
If you should have need to correspond with us regarding this request,
please include the tracking number [NIC-000128.4r50] in the subject. The
easiest way to do this is simply to reply to this message.
If you have not already done so, please come and visit our site via www
browser or ftp and pick-up the latest domain template or review the Domain
Name Registration Service Agreement at the URL's:
Domain Name Registration Service Agreement
<http://www.networksolutions.com/legal/service-agreement.html>
http://www.networksolutions.com/legal/service-agreement.html
Domain Name Registration Template
<ftp://www.networksolutions.com/templates/domain-template.txt>
ftp://www.networksolutions.com/templates/domain-template.txt
Regards,
Network Solutions Registration Services
***********************************************
***********************************************
IMPORTANT INFORMATION
***********************************************
On January 15, 2000, Network Solutions introduced Service Agreement,
Version 6.0. All versions of the Service Agreement template will continue
to be accepted and processed until January 31, 2000. On and after February
1, 2000, please use the Network Solutions Service Agreement, Version 6.0
template located at
<ftp://www.networksolutions.com/templates/domain-template.txt>
ftp://www.networksolutions.com/templates/domain-template.txt
for all template requests.
The terms and conditions of the Service Agreement are available on our Web
site at: <http://www.networksolutions.com/legal/service-agreement.html>
http://www.networksolutions.com/legal/service-agreement.html.
************************************************
The zone files, which make the Internet work, are normally updated twice
daily, 7 days a week at 5:00 AM and 5:00 PM U.S. Eastern Standard Time.
Requests that are completed before these times will be included in that
12-hour zone file update and will normally begin to take effect within 5-6
hours.
Should you wish to modify or delete an existing domain name registration,
you can do so online, using our Service Agreement. You can change the
registrant's address, replace a contact/agent with a different
contact/agent, or change primary and/or secondary name server information.
To update information about an existing contact, such as postal address,
e-mail address or telephone number, complete and submit the Contact Form
to [EMAIL PROTECTED] This form is available on our Web site at
www.networksolutions.com
To register or update information about a name server, complete and submit
the Host Form to [EMAIL PROTECTED] This form is also available on
our Web site.
Network Solutions Registration Services
e-mail: [EMAIL PROTECTED]
You should now be thinking that this message could get you in trouble but
there is a way of getting rid of this trouble. Here you'll use your
mailbomber to mailbomb the guy with 20-30 similar messages if you want
your attack to be successful. The person would see 35 messages from the
same address and therefore would delete all of them and you'd probably be
safe. If he 'would' email someone then he would probably reply to the
wrong tracking number. In the above case, the tracking number is
[NIC-000128.4r50]. OK, here another hard part. You have to open your
notepad and generate similar numbers actually come up with them.
You should NEVER mailbomb the person with the same tracking number. What
we mean
is that you should never send more than one emails to him from
[NIC-000128.4r50] in the next email, change the [NIC-000128.4r50] to
[NIC-000127.5089] or something different. Here is a list of some numbers
that we generated just to give you a good idea of how the scheme works.
[NIC-000127.5089]
[NIC-000128.4rg7]
[NIC-000128.523f]
[NIC-000127.53d0]
[NIC-000129.r609]
[NIC-000128.3f6y]
[NIC-000128.5d8t]
[NIC-000127.r509]
[NIC-000128.4r30]
[NIC-000127.d307]
Remember to change the number at both places. In the subject as well as
the email body!
In the case of wi2000.org you will send the email messages to
[EMAIL PROTECTED] from [EMAIL PROTECTED] The message
subject and body are already described above.
Stop after you have mailed him/her 10-15 messages! Now it's time to email
[EMAIL PROTECTED] with our fake email as
[EMAIL PROTECTED] So again, in this case the message will be
sent to [EMAIL PROTECTED] from [EMAIL PROTECTED]
with the following template that we created above:
******** Please DO NOT REMOVE Version Number ********
Contact Version Number: 1.0
******** Please see attached detailed instructions ********
Authorization
0a. (N)ew (M)odify (D)elete.: Modify
0b. Auth Scheme.............: MAIL-FROM
0c. Auth Info...............:
Contact Information
1a. NIC Handle..............: AMM367
1b. (I)ndividual (R)ole.....: Individual
1c. Name....................: MICKE, ANDERSSON
1d. Organization Name.......: WI2000
1e. Street Address..........: BLIXERED 1
1f. City....................: GOTEBORG
1g. State...................: LILLA EDET
1h. Postal Code.............: 46394
1i. Country.................: SE
1j. Phone Number............: 545326-3445
1k. Fax Number..............: 545326-3445
1l. E-Mailbox...............: [EMAIL PROTECTED]
Notify Information
2a. Notify Updates..........: AFTER-UPDATE
2b. Notify Use..............: AFTER-USE
Authentication
3a. Auth Scheme.............: MAIL-FROM
3b. Auth Info...............: [EMAIL PROTECTED]
3c. Public (Y/N)............: NO
NOTE: Do NOT put anything in the Subject!
Just send one email! Do NOT bomb [EMAIL PROTECTED] with more
than one email. That's pretty much it. Now continue to bomb
[EMAIL PROTECTED], changing the tracking number every time
until your 30-35 tracking numbers are used up!
Now all you have to do is wait. After 24 hours you could go and change the
domain information and no one would be there to stop you because now you
are the admin of the domain name!
NOTE: This attack will only work on domains that have an admin contact
different from their technical contact!
Initiating the Second Attack:
This attack will be successful even if the technical and admin contact are
the same.
The procedure is basically the same apart from the fact that this time:
Go to <http://www.networksolutions.com/>
http://www.networksolutions.com/
- Click on the link that says 'Make Changes.'
- Enter the domain name wi2000.org
- You should be presented with 2 blue buttons
- Click on the one that says *Expert*
- Next screen would have a heading 'Select the form that meets your
needs'
- Click on the link that say 'Service Agreement.'
- Now when it asks for email address, enter your own.
- Now you should see many fields, don't panic!
- Go to the technical contact and change the handle to freeservers,
hypermart e.t.c.
- Now come to 'Nameserver Information.'
- Change the nameservers to hypermart or freeserver nameservers.
- If there's anything in the 'Optional Information' after that then
simply delete them.
- Click on the button 'Submit this form for processing.'
- You are done, the form will be emailed to your email address.
- When the form arrives in your email, then simply take this part:
**** PLEASE DO NOT REMOVE Version Number or any of the information below
when submitting this template to [EMAIL PROTECTED] *****
Domain Version Number: 5.0
******** Email completed agreement to [EMAIL PROTECTED]
********
AGREEMENT TO BE BOUND. By applying for a Network Solutions' service(s)
through our online application process or by applying for and registering
a domain name as part of our e-mail template application process or by
using the service(s) provided by Network Solutions under the Service
Agreement, Version 5.0, you acknowledge that you have read and agree to be
bound by all terms and conditions of this Agreement and any pertinent
rules or policies that are or may be published by Network Solutions.
Please find the Network Solutions Service Agreement, Version 5.0 located
at the URL <a
href="http://www.networksolutions.com/legal/service-agreement.html">
http://www.networksolutions.com/legal/service-agreement.html.
[ URL <ftp://www.networksolutions.com> ftp://www.networksolutions.com ]
[11/99]
Authorization
0a. (N)ew (M)odify (D)elete.........: M Name Registration
0b. Auth Scheme.....................: MAIL-FROM
0c. Auth Info.......................:
1. Comments........................:
2. Complete Domain Name............: wi2000.org
Organization Using Domain Name
3a. Organization Name................: WI2000
3b. Street Address..................: Blixered 1
3c. City............................: Goteborg
3d. State...........................: Lila Edet
3e. Postal Code.....................: 46394
3f. Country.........................: SE
Administrative Contact
4a. NIC Handle (if known)...........: AMM367
4b. (I)ndividual (R)ole?............: Individual
4c. Name (Last, First)..............:
4d. Organization Name...............:
4e. Street Address..................:
4f. City............................:
4g. State...........................:
4h. Postal Code.....................:
4i. Country.........................:
4j. Phone Number....................:
4k. Fax Number......................:
4l. E-Mailbox.......................:
Technical Contact
5a. NIC Handle (if known)...........: BJE41
5b. (I)ndividual (R)ole?............: Individual
5c. Name(Last, First)...............:
5d. Organization Name...............:
5e. Street Address..................:
5f. City............................:
5g. State...........................:
5h. Postal Code.....................:
5i. Country.........................:
5j. Phone Number....................:
5k. Fax Number......................:
5l. E-Mailbox.......................:
Billing Contact
6a. NIC Handle (if known)...........: AMM367
6b. (I)ndividual (R)ole?............: Individual
6c. Name (Last, First)..............:
6d. Organization Name...............:
6e. Street Address..................:
6f. City............................:
6g. State...........................:
6h. Postal Code.....................:
6i. Country.........................:
6j. Phone Number....................:
6k. Fax Number......................:
6l. E-Mailbox.......................:
Prime Name Server
7a. Primary Server Hostname.........: NS1.CAN-HOST.COM
7b. Primary Server Netaddress.......: 24.215.1.6
Secondary Name Server(s)
8a. Secondary Server Hostname.......: NS2.MOUNTAINCABLE.NET
8b. Secondary Server Netaddress.....: 24.215.0.12
END OF AGREEMENT
For instructions, please refer to:
" <http://www.networksolutions.com/help/inst-mod.html>
http://www.networksolutions.com/help/inst-mod.html"
- Now launch your anonymous remailer or mailbomber.
- From: the domain admin ([EMAIL PROTECTED] in this case).
- To: [EMAIL PROTECTED]
- Subject: (do not enter any subject, leave the field blank!)
- Body: the template you created above.
- You are ready to go but before you send this email to InterNIC,
remember to bomb [EMAIL PROTECTED] with similar emails but
different tracking numbers as we did in the first procedure.
- After sending 10-20 emails, send the above template to InterNIC.
- Continue bombing your 40 messages. Remember to generate 40-50
tracking numbers.
- This is basically it.
- The domain would be transferred to freeservers or hypermart and then
you could simply activate it from there on your own email address.
Remember to use a fake email.
Nameservers and Handles:
------------------------
Freeservers Technical Handle: FS4394
Primary Nameserver: NS3.FREESERVERS.COM
Primary Nameserver IP Address: 209.210.67.153
Secondary Nameserver: NS4.FREESERVERS.COM
Secondary Nameserver IP Address: 209.210.67.154
Hypermart Technical Handle: DA3706-ORG
Primary Nameserver: NS1.HYPERMART.NET
Primary Nameserver IP Address: 206.253.222.65
Secondary Nameserver: NS2.HYPERMART.NET
Secondary Nameserver IP Address: 206.253.222.66
______________________________________________________________
Possible Fixes:
Enable the CRYPT-FW password mechanism. This should prevent anyone without
this password from changing your domain information (see the Internic
contact form for more information)
ADDITIONAL INFORMATION
The information was provided by: <mailto:[EMAIL PROTECTED]>
Lucifer Mirza.
-------
AFLHI 058009990407128029/089802---(102598//991024)
- Kirim bunga untuk handaitaulan & relasi di jakarta www.indokado.com
-- Situs sulap pertama di Indonesia http://www.impact.or.id/dmc-sulap/
To unsubscribe, e-mail : [EMAIL PROTECTED]
To subscribe, e-mail : [EMAIL PROTECTED]
Netika BerInternet : [EMAIL PROTECTED]
