Slashdot Mirror
American Samoa Domain Registry Was Exposing Client Data Since the Mid-1990s (softpedia.com)
An anonymous reader quotes a report from Softpedia: A British security researcher that goes online only by the name of InfoSec Guy revealed today that American Samoa domain registry ASNIC was using an outdated domain name management system that contained a bug allowing anyone to view the personal details of any .as domain owner. The researcher also claims that anyone knowing of this bug would have been able to edit and delete any .as domain, just by altering the ASNIC domain info URL. Some of the big brands that own .as domains include Opera, Flickr, Twitter, McDonald's, British Gas, Bose, Adidas, the University of Texas, and many link shortening services. This flawed system has been online since the mid-1990s. The researcher contacted ASNIC after discovering the flaw at the end of January 2016, but email exchanges with the domain registry were scarce and confusing, with the registry issuing a statement today denying the incident and calling the allegations "inaccurate, misleading and sexed-up to the max," after previously acknowledging and fixing the security flaws.
Because there's nothing sexier than a domain registry (to the max)!
This has happened to me at least twice when disclosing security issues. They acknowledge the incident, they fix it, and then they attacked me when I published my report.
Both sides are right. The registrar because the system had been discontinued, and the researcher because the registrar did not notify clients. There, settled! Now kiss and make up.
How about you also give American Samoans the right to vote while you are at it?
I saw this story in the Firehose last night. There were some apparently rejected submissions that looked more interesting but disappeared from the default view. When I view Firehose in Firefox, I don't see the slider that used to be there to change the threshold of posts that show up. Can you bring that slider back?
There seem to be a lot of interesting stories that aren't dupes but don't get posted to the front page. I suspect there are people who'd like to discuss them. In the past, it seemed like Slashdot probably posted about 150% of the amount of stories that get posted today. Is there any way that you can move the rejected non-dupe, non-spam, and non-Forbes submissions somewhere else that we can discuss them? In the past, pages for each section like YRO had an assortment of front page stories and stories that only appeared in that section. That might be a good place for stories that are interesting but don't make the cut for the front page.
Yes, I'm partially griping because my Snowden submission seems to have been rejected. But I also see a lot of interesting stuff that never gets posted and might be worth discussing somewhere. The quality of discussion would probably be better, though the comments would be fewer. My project for my statistics class in my freshman year of college demonstrated that the proportion of -1 posts on stories only on section pages was lower than front page stories in a very statistically significant manner.
shut uppppppp!!
America is synonymous with freedom. Of course this data would be freely exposed. Isn't that what you open source people want, anyway?
Information and data wants to be free for all to mooch!
This is what happens in small countries where everyone knows everyone. You can't fine the registrar for poor security because he's probably married to your cousin.
No surprise. Just search reddit for horror stories of having to move .as domains from one DNS to another. That registrar is horrendously bad.