Domain hijacking
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
Domain hijacking or domain theft is the act of changing the registration of a domain name without the permission of its original registrant, or by abuse of privileges on domain hosting and registrar software systems. [1]
This can be devastating to the original domain name holder, not only financially as they may have derived commercial income from a website hosted at the domain or conducted business through that domain's e-mail accounts, [2] but also in terms of readership and/or audience for non-profit or artistic web addresses. After a successful hijacking, the hijacker can use the domain name to facilitate other illegal activity such as phishing, where a website is replaced by an identical website that records private information such as log-in passwords, spam, or may distribute malware from the perceived "trusted" domain.[3]
Description
[edit]Domain hijacking can be done in several ways, generally by unauthorized access to, or exploiting a vulnerability in the domain name registrar's system, through social engineering, or getting into the domain owner's email account that is associated with the domain name registration. [4]
A frequent tactic used by domain hijackers is to use acquired personal information about the actual domain owner to impersonate them and persuade the domain registrar to modify the registration information and/or transfer the domain to another registrar, a form of identity theft. Once this has been done, the hijacker has full control of the domain and can use it or sell it to a third party.
Other methods include email vulnerability, vulnerability at the domain-registration level, keyloggers, and phishing sites. [5]
Responses to discovered hijackings vary; sometimes the registration information can be returned to its original state by the current registrar, but this may be more difficult if the domain name was transferred to another registrar, particularly if that registrar resides in another country. If the stolen domain name has been transferred to another registrar, the losing registrar may invoke ICANN's Registrar Transfer Dispute Resolution Policy to seek the return of the domain.[6]
In some cases, the losing registrar for the domain name is not able to regain control over the domain, and the domain name owner may need to pursue legal action to obtain the court ordered return of the domain.[7] In some jurisdictions, police may arrest cybercriminals involved, or prosecutors may file indictments.[8]
Although the legal status of domain hijacking was formerly thought to be unclear, [9] certain U.S. federal courts in particular have begun to accept causes of action seeking the return of stolen domain names.[10] Domain hijacking is analogous with theft, in that the original owner is deprived of the benefits of the domain, but theft traditionally relates to concrete goods such as jewelry and electronics, whereas domain name ownership is stored only in the digital state of the domain name registry, a network of computers. For this reason, court actions seeking the recovery of stolen domain names are most frequently filed in the location of the relevant domain registry.[11] In some cases, victims have pursued recovery of stolen domain names through ICANN's (Uniform Domain Name Dispute Resolution Policy (UDRP), but a number of UDRP panels have ruled that the policy is not appropriate for cases involving domain theft. Additionally, police may arrest cybercriminals involved.[8][12][13][14][15]
Notable cases
[edit]- During the original "dot com boom", there was extensive media coverage of the hijacking of "sex.com".[16]
- Basketball player Mark Madsen unknowingly bought a "stolen" (or hijacked) URL by way of eBay auctions.[17]
- In 2015 Lenovo's website and Google's main search page for Vietnam were briefly hijacked.[18]
- In early 2021, Perl's domain was briefly hijacked,[19][20] causing a relatively major issue with CPAN.[citation needed]
- On August 19th 2024, FurAffinity's domain was hijacked for over a day, redirecting users to a Washington Post article, then to KiwiFarms a short time later.[21][22]
Prevention
[edit]ICANN imposes a 60-day waiting period between a change in registration information and a transfer to another registrar. This is intended to make domain hijacking more difficult, since a transferred domain is much more difficult to reclaim, and it is more likely that the original registrant will discover the change in that period and alert the registrar. Extensible Provisioning Protocol is used for many TLD registries, and uses an authorization code issued exclusively to the domain registrant as a security measure to prevent unauthorized transfers.[23]
RFC’s
[edit]- RFC 3375 - Generic Registry-Registrar Protocol Requirements
- RFC 3735 - Guidelines for Extending EPP
- RFC 3915 - Domain Registry Grace Period Mapping (e.g. Add Grace Period, Redemption Grace Period)
- RFC 4114 - Using EPP for ENUM addresses
- RFC 5910 - Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP) (obsoletes RFC 4310, DNSSEC)
- RFC 5730 - Extensible Provisioning Protocol (EPP) (obsoletes RFC 4930, which obsoleted RFC 3730)
- RFC 5731 - Extensible Provisioning Protocol (EPP) Domain Name Mapping (obsoletes RFC 4931)
- RFC 5732 - Extensible Provisioning Protocol (EPP) Host Mapping (obsoletes RFC 4932)
- RFC 5733 - Extensible Provisioning Protocol (EPP) Contact Mapping (obsoletes RFC 4933)
- RFC 5734 - Extensible Provisioning Protocol (EPP) Transport over TCP (obsoletes RFC 4934)
See also
[edit]References
[edit]- ^ "Preventing Risks From Subdomain Takeover - Cloud Exploits". The Hack Report. 10 February 2021. Retrieved 14 April 2021.
- ^ Simon, Ruth (12 March 2015). "Cybercriminals Are Misappropriating Businesses' Web Addresses As a Result, Customers Can't Find the Real Companies on the Web". The Wall Street Journal. The Wall Street Journal. Retrieved 12 September 2016.
- ^ Weslow, David. "Dealing with cybersquatting: the wisdom of thinking ahead". TBO: Trademarks & Brands Online. Archived from the original on 31 March 2022. Retrieved 12 September 2016.
- ^ "CLBR Featured Segment: David Weslow on Domain Theft". Cyber Law Radio. July 2015. Retrieved 12 September 2016.
- ^ "Domain Name Hijacking". 31 December 2014. Archived from the original on 12 December 2016. Retrieved 13 May 2017.
- ^ "Registrar Transfer Dispute Resolution Policy". ICANN. Retrieved 12 September 2016.
- ^ "Domain name theft: Knowing where to turn". TBO: Trademarks & Brands Online. Archived from the original on 4 August 2016. Retrieved 12 September 2016.
- ^ a b Mike Masnick (4 August 2009). "Criminal Prosecution For Domain Hijacking". Techdirt. Retrieved 19 June 2019.
- ^ Smith, Gerry (29 September 2014). "When Hackers Steal A Web Address, Few Owners Ever Get It Back". Huffington Post.
- ^ Berkens, Michael. "Wiley Rein Files Suit Over 14 Stolen Domain Names: 9 Are 3 Letter .com's". The Domains.
- ^ Allemann, Andrew (23 October 2014). "Lawsuit filed to recover stolen three letter domain names". Domain Name Wire. Retrieved 13 September 2016.
- ^ "WIPO Arbitration and Mediation Center". Retrieved 12 September 2016.
- ^ "WIPO Arbitration and Mediation Center". WIPO: World Intellectual Property Organization.
- ^ "Mascot Media Circle, LLC dba OnlineMBA v. WhoIsGuard, Inc. / Ahmed Guettouche Case No. D2015-1209". WIPO: World Intellectual Property Organization. Retrieved 12 September 2016.
- ^ "DECISION Donald Williams v. wangyan hong". Forum: Arbitration, Mediation, International. Retrieved 23 April 2017.
- ^ Dawn Kawamoto. "Sex.com domain hijacker captured". CNET. Retrieved 19 June 2019.
- ^ "Man Who Sold Web Domain to Mark Madsen Going to Jail | SLAM". Slamonline.com. 26 July 2011. Retrieved 19 June 2019.
- ^ Kirk, Jeremy (26 February 2015). "Lenovo, Google websites hijacked by DNS attacks". PC World. Retrieved 12 October 2018.
- ^ Richard Speed. "Perl-clutching hijackers appear to have seized control of 33-year-old programming language's .com domain • The Register". The Register. Retrieved 16 March 2024.
- ^ brian d foy. "The Hijacking of Perl.com". Perl.com. Retrieved 16 March 2024.
- ^ Noblitt, Elissa (21 August 2024). "Furry Art Platform Fur Affinity Was Taken Over by Hackers: "Do Not Interact With the Website"". Distractify. Retrieved 21 August 2024.
- ^ "Aug 22nd - All Our Base Are Belong To Us -- Fender's Journal". www.furaffinity.net. Retrieved 22 August 2024.
- ^ Internet Corporation For Assigned Names and Numbers (15 July 2005). "DOMAIN NAME HIJACKING: INCIDENTS, THREATS, RISKS, AND REMEDIAL ACTIONS" (PDF). Retrieved 17 October 2014.