Slashdot Mirror
Dell Lost Control of Key Customer Support Domain for a Month in 2017 (krebsonsecurity.com)
Brian Krebs reports: A web site set up by PC maker Dell to help customers recover from malicious software and other computer maladies may have been hijacked for a few weeks this summer by people who specialize in deploying said malware, KrebsOnSecurity has learned. There is a program installed on virtually all Dell computers called "Dell Backup and Recovery Application." It's designed to help customers restore their data and computers to their pristine, factory default state should a problem occur with the device. That backup and recovery program periodically checks a rather catchy domain name -- DellBackupandRecoveryCloudStorage.com -- which until recently was central to PC maker Dell's customer data backup, recovery and cloud storage solutions. Sometime this summer, DellBackupandRecoveryCloudStorage.com was suddenly snatched away from a longtime Dell contractor for a month and exposed to some questionable content. More worryingly, there are signs the domain may have been pushing malware before Dell's contractor regained control over it.
I've got to wonder if the Internet has caused a *lot* more problems than it's solved.
"I don't know, therefore Aliens" Wafflebox1
In large corporations itâ(TM)s often easier to register a new domain than go through the hoops of getting a subdomain approved.
Where I work, it takes me $8 and a half hour work to get a domain but it can easily take me 6 work hours across 2-4 weeks to get a subdomain.
Custom electronics and digital signage for your business: www.evcircuits.com
As a Dell employee, I couldn't agree more. We're heading into open enrollment right now for next year's benefits, and there are a bunch of web sites that we use for various parts of it, and while they all have "dell" in the domain name, none of them are subdomains off of dell.com. It's crazy.
And this after the security training where we were told to watch out for suspicious domain names.
I suspect the reason is that they keep everything under dell.com controlled by Dell directly, so anything contracted to an outside vendor needs its own domain. But at the very least, they should set up for all the valid domains a redirect from subdomain.dell.com to subdomaindell.com so they could still advertise a professional-looking domain.
Precisely because any idiot can register a domain with dell in the title, but to get an authorised subdomain.dell.com goes through a verification process and is immediately and obviously representative of Dell as a corporation.
This is the exact point, I think, and what you WANT to be doing.
I've gone to great lengths to remove all the old crappy domains that my workplaces insisted on buying up, or using for one-off events, and pushing everything under subdomains. To the point that "drive.domain.com" is actually our Google Drive link (so it automatically knows to sign you in with that domain account rather than your personal GMail, etc.).
Literally any idiot on the planet can register a domain with your name in. Chasing and pre-registering such - unless you hold a trademark that you need to enforce - is almost impossible, and an endless game of new TLDs and tricks (e.g. "fordsucks.com") make it a no-win game.
Buy one domain. Put everything on it. Hell, buy two so you have a backup (e.g. companyname.com, companyname.countrycode) and can quickly tell people "don't use the .com, use the local domain for now until we're back up, as it points to our secondary systems and always has."
But myriad psuedo-related domain names that you forget about while they're running business-critical systems with live user data and the expectation that you'll own them forever is a really stupid idea. And... technically... who owns those domains? Did you register the correct contacts, could you take it over if you wanted? What about the DNS does it actually go to your company's DNS or goes it bounce via yours thus leaving the company in a fragile position should you leave or want to snoop data (e.g. SSL is reliant on DNS being authoritative)? Do those domains have the company SPF fields? Are they included in the main mail domain's SPF record? DKIM? SSL certificate? There are no end of reasons to actively block such adhoc registration in preference to FORCING YOU to jump through the hoops.
"An easy life" and "security" are often polar opposites.
I've got to wonder if the Internet has caused a *lot* more problems than it's solved.
Let me put your mind at ease. The internet has caused new problems to be sure but it has resolved even more old ones. I'm old enough that I pre-date the internet in anything remotely resembling its current form and I pre-date the world wide web by multiple decades. I can assure you that the Good Old Days weren't all that good and that the the internet has solved substantially more problems than it has caused. Nothing is perfect and people are still just as incompetent as they ever were but that doesn't mean the technology is a bad thing.