Slashdot Mirror
Network Solutions E-Mail Security Alert
Ralph writes: Network Solutions has starting spamming some of its customers with notices that include, among other things, the news that they've set up a free e-mail account for you, without bothering to ask first, at their new dot com now mail Hotmail clone. They've even taken the liberty of assigning you a password:
3. Lastly, we are pleased to offer you a FREE e-mail account using our new dot com now mail service. Because it's Web-based, you can use it in the office, at home or on the road. You'll need the following information to set up your account:
>>>>>>>>>>>>Login name: domainid >>>>>>>>>>>>Password: domainidnsi
Note that nifty password? It's the same pattern for every domain they've registered an e-mail address for.
Big security [bleep]up. If someone beats you to your account and "guesses" your password, now they can masquerade as you, and if they change the password, you can't even get into the account.
I've already gone into my "accounts", verified that they exist, and changed the passwords. I know that they exist because when I entered other domain IDs I control that I wasn't spammed at, I was returned to the login screen rather than being brought to a presumably newly-created mail page.
I called Network Solutions tech support to demand that they remove the accounts, but the moron on the line didn't understand that they were doing something incredibly boneheaded and wouldn't listen to my explanation. The person on the line insisted that they wouldn't create an account without me signing up for it, but I didn't have to sign up; it was already in place.
The mail I received started out "As a customer of Network Solutions or one of our Premier Program members", so I'm not sure if they're doing this for everyone or just for people who bought their domains through some of the big providers like Pair who are part of the "Premier Program". If you get the e-mail from them, I suggest logging on immediately and changing your password, whether you wanted the account or not. Maybe with a little prodding, Network Solutions will realize they screwed up and delete the accounts and change their procedure.
Update posted 2:10 p.m. EDT by RM - doulos writes "If your tired of getting a busy signal at the 703-... phone number, I found that they have a nice staff of people waiting to answer your questions and complaints at the following TOLL FREE phone number: 1-888-642-9675
They did refer me to the toll-line, but I (politely) insisted that because this was a matter of security that they had initiated, that I should be able to at least speak with a supervisor. They nice person on the phone _politely_ complied, and I was able to put in my request to have those e-mail accounts removed with my appropriate domains.
I just thought I would submit this as an article update because I felt maybe if the phone # was posted as an update it might help alieve some of the offense of having to call, by at least removing the toll from being on your nickel..."
OK,
However much you may hate XXXX corp DO NOT try and masquerade as them!
It's not big, clever or AFAIK legal.
What may seem as a good idea right now may land you/us/everyone in the world in a whole heap of trouble.
----- Documentation is worth it just to be able to answer all your mail with 'RTFM' - Alan Cox.
What kind of programmer can create an entire web based email system, write the code, and bring the whole system to working order, and then ignore one of the basic principles of password choice that has been a major no-no in the un*x (and other) operating system for decades.
Mind you I guess it's not surprising when we consider the other screw ups we've seen lately - even in other web based email systems like the recent hotmail scare.
All we can do is hope that they will be a learning experience for us all, and that screw ups in the "early" days of the internet for the masses will prevent (or at least lessen the effect of) major security holes in future systems..
First they produce copyright restrictions in whois queries that people cannot opt out of. Then they fight tooth and nail with government regulators over divvying up their monopoly. Now this?
What's next, my bank creating an email account for me and assigning it the password 123456, like everyone else's?
Just imagine the possibilities of such a monumental foul-up:
-) Email Masquerading:
"Hi InterNic Tech Support, this is so-and-so, I'd like my contact information changed to... No, I'm really so-and-so. You can tell because I'm emailing you from so-and-so's account..."
-) Spam, Spam, Spam, Spamitty-Spam:
"You've got mail! Oh joy, so-and-so@internic is spamming me. Lets get them blacklisted and ban their server."
-) Misrepresentation via Email:
With this, and some of the information available from a standard whois query, you easily order products and have them shipped to someone COD. And of course, it's authentic because it was shipped from your internic account....
Someone stop the madness before it continues to spread!
Either my company's email boxes have not been created, do not use the stupid password, or someone has logged in and changed them.
--- If you don't want to know the answer, don't ask the question.
Okay this has way too much potential. How long is it going to take them to clean up the aftermath? I see another mess of legal battles over this one, and maybe because it's so prominent, we might see some penalties for boneheaded admins like this one. (Oh please, oh please, oh please? We need a legal precedent that makes "blatant neglect" a crime.. heh)
... class-action lawsuit?
Who wants to keep track of how much time is lost due to this?
Anyone know how I can figure out what other accounts I might have?
Just when you thought you'd seen it all, NSI sinks to a new low! I just noticed a name I control affected, too. It appears that they may still be in the process of rolling this out, as the oldest domain got this account, but the others haven't (yet, at least).
Also, I think it's disturbing that something important as control of your domain name is left wide open by only offering cleartext passwords. i.e, even if you *do* log in and change your password, it can be seen in transit and your name can still get hijacked.
I think this is a demonstration of NSI's utter incompetence/unwillingness to take due dilligence and that their contract should be terminated.
Paul.
You are lost in a twisty maze of little standards, all different.
Looks like it's either /.ed or their servers are offline while they fix this little "problem". .....Heh, I just made myself laugh pretty hard writing that last comment ;) This is truly unreal.
"Klaatu, verada, necktie!" -Ash
If we can expect quality service like this because of it, I'm all for monopolies over services, products, whatever you got! Tell Uncle Sam to stick it.. Let those businesses continue to deliver the good stuff until it hurts!
Warning: The views expressed in this message are not necessarily shared by the poster, Slashdot, or the free-thinking populace at large.
~ Kish
I just got the spam from NS, and it was a bit different than described. The account name was the administrator's last name with a random number added; not the domain name as described. The password was as described; the account name with "nsi" added to the end.
A bit better; anyone trying to screw up somebody's account would have to know how to use WHOIS and guess a short number.
Clueless. Utterly clueless. And these are the guys who claim to be running the Net??
My password is now a random string that I've already forgotten. Why would I need another e-mail account anyway? Don't you have to have an e-mail address (contact point) to set up a domain name?
Yep, same story - blank page. Either NSI have really taken it down or it's suffered the slashdot effect(tm) ;-)
It's /.ed. Very ironic if you ask me. I managed to get through after about 15 reloads.
Am I the only one that thinks emailing out unsolicited passwords in plain text is a bad idea in the first place? Unencrypted email's not exactly the most secure way of transferring information. There may be times when I *request* a password via email, but I do so knowing and accepting the risks, and I wouldn't do it with something I couldn't afford to be compromised. Of course, the choice of password was dumb beyond belief as well, but that's a separate issue...
"The invisible and the non-existent look very much alike." -- Delos B. McKown
Network Solutions...we're the "duh" in dot com!
If someone beats you to your account and "guesses" your password, now they can masquerade as you, and if they change the password, you can't even get into the account
I'm probably just extremely dense, but isn't dotcommail just yet another free mail service?
do you really think people are stupid enough to think that a mail from 'slashdot@dotcomnow.com' (or 'slashdot@hotmail.com' which I just grabbed) must necessarily come from someone working for slashdot?
if that's the case, we're in deep trouble. there are hundreds of free mail services out there...
I took a look at this story and hurried over to the NSI website and the account I use to register some domains to check this out. Nothing.
I am glad there was nothing, no dotcomnow account that I can think of and no email with my nice little present from Netsol. If there was, I guess I might have joined in the frenzy here.
This got me thinking about what the "security hole" is.
a) That account cannot be used to change my domain parameters, since it does not match the e-mail address I registered from.
b) Anyone can really set up an account on one of thousands of webmail providers and pretend to be me. Heck, this has happened to me before on some discussion groups, and there is simply nothing I can do to prevent someone from misrepresenting me to lusers. People who know me know where my e-mail comes from, and know I use digital signatures.
c) How is this different from your friendly bank sending you a credit card without your approval? Infact that is something which I consider more dangerous than this act of stupidity by Netsol.
Having said this, I seriously think we're over reacting.
Shri -- returning to the scheduled Typhoon York.
Go to http://mail.dotcomnow.com and click on preferences. You can change your password from there.
it's moments like this that i decided to drop NSI and register my current domain with one of the other registrars.. i.e. register.com and the like.. they atleast appear to have more than a clue than NSI does, unfortunately, people still use 'whois' to look up a domain, and since that only looks at NSI by default, well, makes life harder... but i'm not surprised that NSI would do something this dumb... i tried 6 times to get them just to change my CONTACT INFO, and oops.. sorry, we lost your pgp key, (and since i can't mail from the email in my contact info anymore.. too bad), thank god i don't hold any domains with them now..
Hrm, has the thought occured to anyone that by alarming all of us slashdotters to this not-so-important security hole that the hype and alarm of this story rushes each and every one of us to _GIVE NSI A PASSWORD_. Most folks dont believe in smart passwords. Most folks use the same password everywhere.
You may have just given NSI more power then they deserve.
Wouldn't you just love to be a corrupted employee working for dot com mail?
Just think... if you were, you'd have passwords to hundreds of thousands of root accounts, etc.
God, what the hell were you guys thinking doing this. Big whoop. Spank NSI.
But realize that this is a double edged sword.
-krs
If it works like that; what's the domain id for 'etrade.net' or 'etrade.org'?
:(
More likely is indeed the last name of the administrative contact. I've already found several that work that way
Good luck...
barbaBob
--
*sig*
I tried this particular little 'trick' with a random domain, and there was no 'account'. SO, they must be being selective ass holes. -C
"This above all, to thine own self be true"
We probably are reacting a bit over the top, but the scary part is that at least three of the 'lastname' and 'lastnamensi' get me into someone elses e-mail account.
You're right about there not being a real security at the moment. Only people who used their Dot Com Mail address as their contact's e-mail address will be at risk of losing control of their domain, since most of them use 'MAIL-FROM' as their authentication method for authorizing changes to their domain registration.
It does make me think about advertising ourselves as a 'Network Solutions Partner' though. But then again, I doubt that you'd be really better off with any of the other TLD registrars.
Cya
barbaBob
--
*sig*
Wow... :)
I'm impressed... It's been a while since I saw a monumental cockup like that (well, since the hotmail affair anyway).
I'm sure that a couple of minutes adding a check with cracklib wouldn't have gone amiss, or just adding in a random password generator..
I wonder.. Do these people have a QC department, to make sure that the code they release is robust?
Or is a building of PHBs with a lone coder stuck in a cabinet somewhere and let out to be fed and watered every now and then..
For a large company with huge resources at their disposal, there's no excuse for not checking their functionality a hundred times before release... Especially as this is supposed to be their core business!!!
I'd love to see their PR dept. right now..
No. NetAddress has nothing to do with Network Solutions, and that fiasco is something else in itself. Mine works.
So basically, if I don't want stupid emails like this, I have to give up "real-time" communication from NSI about my account? That sounds kind of stupid, don't you think?
Sujal
politics, food, music, life: FatMixx
OK, gotta get the music to that strangely addictive game out of my head now.
Check out this piece of wholesome goodness, delivered in the same message as my (cleartext) domain hijacking password:
If you do not wish to receive e-mail from Network Solutions, click on this
+e-mail address and type "remove" in the
+subject line.
PLEASE NOTE: by opting to be removed from this list we will not be able to
+communicate to you, in real-time, on issues regarding your account.
The mind boggles. One of the primary aspects of the net's formative power is its ability to quickly report the consensus of a company's customer base. Emails such as the one recently sent to all domain owners--containing both an unprecedented security breach and a jaw-dropping amount of arrogance(read our spam or we lose your bill)--only serve to increase internal communication within NSI's customer base, and to erode and eliminate the trust that the company has built up over the years.
I am positive there are alot of others out there like myself who hold a great deal of technical respect for their extremely high-uptime management of the closest thing we have to a single point of failure. They've done much right, and honestly, they've scaled better than one might have expected considering their ever increasing workload and the sheer number of years they've been doing their job.
I almost see a parallel to Microsoft here. People complain that the Windows 9x kernel is buggy, but considering that it runs everything from ancient DOS games to 32 bit applications, it's a miracle it runs at all. There's some truly respectable hackery involved in that! However, nobody, not even Microsoft's staunchest allies will say that their businesspeople are the most ethical in the industry, and most of the industry will claim that the Microsoft businessdroids have even less faith in their coders than the Linux bigots.
Why else fudge the numbers and force the shipments? Nobody's going to run Internet Explorer unless they're forced to...so lets force 'em. That seems to be the mindset.
Similarly, the Network Solutions folks have pulled off some significant technical miracles, but their business side is obsessed with the concept that nobody cares about anything technical. Since nobody would use NSI if they had an alternative registrar, the quality and quantity of alternatives must be fought tooth and nail. Since NSI is nothing but its collection of names and addresses retrieved under contract from the federal government, they'll claim de facto ownership of the WHOIS database until the Commerce Department's gun is pointed at their head with the hammer cocked.
Nobody cares about name resolution, you see. The real fad is WEB BASED EMAIL; create accounts for people without even following basic security procedures!
Nobody would actually want any of the services offered by NSI through email, so issue a vague threat to cut off all email--even that which is critical to the operation of one's domain--unless the domain owner agrees to sift through the latest thing being hawked by NSI.
The more NSI does in this style, the more they disenchant, disenfranchise, and disconnect themselves from their customer base.
There's no logical reason for this to occur.
I call all of this the PARC Lemming Syndrome. Every hi-tech businessperson secretly(or not-so-secretly) laments that he or she wasn't there at Xerox PARC to bring all of those amazingly profitable inventions to market. The agony of imagining so many lost dollars causes them to try to milk whatever or wherever they're at without due concern for what this will actually do to the businesses Core Competency.
To the businessperson...maybe he's breaking loose, pulling ahead of the pack, about to lift off, ascend to new hights...or maybe she's in the middle of a herd, trailblazing, secure in the knowledge that together new possibilities are being forged.
The the customers, and the rest of us...just looks like a bunch of lemmings racing headlong towards a cliff.
I implore you, Network Solutions. Buy a clue. Get a twelve pack if needed. Your customers trust you because your uptime is unbeatable, your security is generally reasonably tight, and because you've been doing it right longer than anyone else in the business. I'm one of your customers. Before you tell me anything, offer me anything, or do anything, think of why I do business with you, and about what could make me stop.
Don't be a lemming!
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
Once you pull the pin, Mr. Grenade is no longer your friend.
This is frankly amazing. Not only that such a large, allegedly net-savvy company could make an elementary security blunder(*), but that they even thought to was a viable business plan.
After all, all existing domain holders already have valid contact addresses(**) and don't need another poxy webmail account. They're also likely to be the kind of net users who'd not use webmail for importantish stuff. Maybe they just wanted to be able to claim X current users to advertisers, whilst not telling them none of the actually use the service.
Just glad they don't seem to have included any domains I'm involved in...
(*) Hey! Has anyone tried to get root at NSI using the password 'nsinsi' or something?
(**) Except for the spammers, obv. Maybe NSI were aiming the service at spammers. That would certainly fit their modus operandi.
--
So i went and changed the PW for the doms I manage- and I made a mistake... I got the email, it said xxxxx4 for user, and I jusr type xxxxx, so I accidentally changed the wrong password! D'oh!
friggan turds.
Surfing the net and other cliches...
Surfing the net and other cliches...
(Who Meta-Meta-Moderates the Meta-Moderators?)
Bahahahaha
I just sucessfully picked 3 random names
and added nsi to the end for the password and it actually let me log in=P
The stupidity of some people...
I had the problem, now it is fixed. It's some other glitch, apparently. Zed
I can just see that moron sitting in his office now.
/.ed.
"Hey, look! My new e-mail service is getting tons of hits! Wow, it's only been available for a few hours, and everyone is logging in with their new accounts! Unbelievable! I'm going to be a huge success! I'll be on the cover of Fortune. Hotmail, move over, baby." (sound of smacking lips)
So let's all contribute to his trumped-up feeling of greatness. I'm logging in with every name I can find (someone else's, of course) and sending congratulatory e-mails to webmaster@dotcomnow.com about what a wonderful service this is, blah blah blah.
FYI, http://mail.dotcomnow.com still works, even though the original URL sent out in the e-mail is
And before you try it, I've already snatched clinton, lewinsky, and elvis. Heh heh heh....
What's your damage, Heather?
Also, the login screen is completely insecure! No SSL or anything. Atleast hotmail passwords don't go over the net as plaintext!
Can't make it work with contacts outside the US of A. All the last names that work are from people that live inside the US. Guess I am lucky after all ;)
barbaBob
--
*sig*
What has happened to the IT industry? Quite simply too many clueless people are being employed, usually hired by equally if not more clueless management.
I've seen networks brought to their knees entiely due to management making decisions on the network topology. I have seen distributed networks fail due to a management descision to consolidate all logins to one single server! (Doh!) I have spent hours trying to bring dead systems back to life because no one bothered to maintain or monitor the system for 7 years, hoping the system would look after itself, and once I got it working the machine suffered a catastrophic hardware failure, and no more spares were avaialble world wide. And it goes on...
The most ironic thing is that earlier this year I spent 4 months out of work. For every single interview, the decision rested on someone with no technical experience. I've found a position now, but it is 200 miles from home, and half the team I have to work don't deserve their position.
There are too many fools in this industry making decisions. No wonder NT is so bloody popular.
The moron who thought of this, and the bozo who hired him should never be allowed to touch a keyboard again.
NSI has subscribed to the bes possible security flaw of all - The Slashdot effect. Now that they are hosed, noone can get to their accounts! (At least I cannot seem to get in - timeouts on the site galore)
Well, in all the fuss, did anybody miss the part in the famed NetSol email saying that as of Sept. 18th, we have to start paying for domain names in full at the time of registration??? How much does that suck?
So, I checked out the the dotcom directory and it looks like you can change anyone's information. If you go to "Update Your Listing" search for a domain. They give you all the fields to update and say that they will call you to verify. BUT then they give you a box to enter in alternate contact information.
~ ~~~~~~~
My guess is all you would have to do is change things put in a fake name, verify it when they call you and your all set.
Okay, so it's not critical information. But some people might be depending on this engine to find information about companies. Network Solutions is supposed to be a reputable company.
I'm still waiting for my phone call to see what they use to verify I have permission to change a companies information.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
How many surrealists does it take to screw in a lightbulb?
Fish.
very good post, and people should read the essay linked to. Just one point to save you some trouble later:
The phrase "Core Competency" is a [tm] trademark of Gary Hamel, a management science professor at the London Business School. He's a cool enough guy (I know him), and doesn't usually get heavy over the fact. But he makes his living out of going round talking to companies as "the Core Competency[tm] guy". So he's a bit touchy if anyone else tries to pass themselves off. And sometimes he feels obliged to defend his trademark in order to stop it passing into the public domain ("use it or lose it")
I'm not sure what your firm DoxPara Research does, but if you're planning on using the phrase "Core Competency" in a consulting context, you might want to send ghamelATlbsDOTacDOTuk a message, just to keep everything above board.
Me, I'd say screw it, trademark law's a crock and the thing's probably gone public domain anyway by now. But the information can't make you poorer.
this free business advice brought to you by
jsm
I just changed the password for my own personal domain, but that got me thinking and I tried to guess the login/password for the domains of my customers.
Nearly every single one of them has ended in the digits 57. Within a few minutes of picking common names and numbers around 57, I was able to log in to dozens of accounts. It was hard to resist the temptation to commandeer account gates57 =)
I don't think we're overreacting. I think it's disturbing when someone so big does something so stupid. Think about how much we rely on this company for our day-to-day services, and how tough their security should be. They should have extremely stringent standards.
.666 so far .
Someone assigned every single account the same password, in essence. This violates so many common sense rules that it's amazing: easy-to-guess user names, standard passwords, passwords sent out in regular e-mail, no authentication process, yadda yadda yadda. I mean, I just logged on and snagged three major commercial sites, just to see if I could do it. I'm batting
If I did something that stupid and assigned all my local office users with easy-to-guess passwords, it would be no big deal, because I'm small potatoes. But when a giant like NSI does it, it's insulting to all of us. None of us would make that mistake, and it's fair to say that most of us probably aren't getting paid whatever the NSI schmuck was.
What's your damage, Heather?
Can't believe this. 'webmaster' is wide open as well. There's e-mail from 'clinton', 'elvis' and a few others.
I changed the password. I'll mail it to postmaster@netsol.com later on. Jeez....
--
*sig*
If you do not wish to receive e-mail from Network Solutions, click on this e-mail address and type "remove" in the subject line. PLEASE NOTE: by opting to be removed from this list we will not be able to communicate to you, in real-time, on issues regarding your account.
So by opting out of their spam, you are opting out of ANY communication from them at all regarding your domain(s).
To paraphrase The Who, "Who the fuck are they????????
Bite My Ziff, Davis!
======
"Cyberspace scared me so bad I downloaded in my pants." --- Buddy Jellison
Sacred cows make the best burgers.
This is absolutely crazy, and I want it to be the last straw. I have been screwed over by NSI both personally and professionally now:
All in all, NSI has screwed me over again and again, and their callous disregard for professionals that need to get their jobs done by not even allowing me access to engineers (after repeated requests) to repair the aforementioned host handle problem is a load of bullshit.
Now, to the thrust of this posting -- where can I find these so-called alternative registrars? Are they yet capable of freeing me from the shackles of NSI -- to the point of never having to email anyone at networksolutions.com again -- and still keep my .com, .org, and .net's?
I sincerely hope that if they are not here now, that they arrive very soon. I have a lot of new business for them.
When I tried to access my dot.com webmail (what a dorky name), I was told to go to mail.domainname.tld, which redirected me to my mailserver since I already register that machine name in my DNS settings.
---
This sig has been temporarily disconnected or is no longer in service
So far, I've only been able to get into 2 domains using the admin's last name and admin's last name & nsi. I haven't found any domains or any of my domains where I could use admin last name & handle number.
Passwords are extremely guessable as they are limited in length as well with extra characters being ignored.
This reminds me of when the New York-based phone company Nynex (now Bell Atlantic) sent out a mass mailing to /all/ their subscribers containing a phone card and the matching pin #. Needless to say, many cards fell into the wrong hands, and all hell broke loose...
And people worry about electronic privacy. They should be more worried about gross ineptitude.
_______
2B1ASK1
Okay,
/.'ed, they took it down, or it's another example of NSI icompetency. ( I suspect a combo of the first and last. :P )
The link in the email is either
My username/password was not related to any of my NIC handles in any way. The password was the combo of 'username+nsi' which is truly awful as already noted here.
You can go to http://mail.dotcomnow.com to access your account, so they definitely *haven't* taken the site down.
I logged in, changed my password, set up the vacation message, and sent mail to NSI expressing my displeasure at this rather silly attempt to gain yet more business from me ( it ain't gonna happen. )
So now, when they reply to my emails, they'll get my autoreply vacation message.
Hrm... wonder if there are any autoresponders at NSI that I could mail from my wonderful new account... ( heh )
---
Segmentation Fault ( core dumped )
Okay, I'm confused. I wasn't offered a new webmail address in my own domain. I was offered some idiotic "whatever@dotcomnow.com" address.
If they had tried to pull something on redirecting mail on my domain at all, you can bet I would be down to Herndon (they are in Herndon, aren't they?) as fast as I could with an aluminum bat demanding to see the person who made that decision.
As I read this, it means that if I choose not to get their spam, then they will not email me anything at all! Like "Your domain is being shut down". Now maybe that isn't really what they mean -- but if not they are deliberately making it sound like that's what they mean.
I really, really, really resent this. Guys -- it is clear that Network Solutions and the domain name system in general is completely, totally out of control. I have been waiting 5 years for some reasonable new TLD's. Waiting, with no luck. All because of network solutions. I want these jerks out of business, and I think I know how.
I think it's time to start our own DNS, a la alternic. If we could get participation from slashdot participants, we would probably cover 50% of the net. If we really agressively pushed it, we could probably get 90% coverage.
*sigh* It would probably never work, but internic makes me mad.
-- Slashdot sucks.
Re: the NSI web-base email password fiasco
Now, I can't even get online! The server must be down or just bogged by people trying to break in to the server. What a load of crud...
I just noticed that the email I got came from netsol1@INTEGRAM.ORG, which whois's to:
INTEGRAM (INTEGRAM4-DOM)
2730 Prosperity Ave.
FAIRFAX, VA 22031
US
They don't seem to have much in common with NSI. their web address seems to be an empty directory (has the apache feel to it though).
So, what gives with this?
...with Lily Tomlin as a spokeswoman for the phone company:
"We'll sell your personal information if we feel like it. We'll privitize public information. We'll set up an e-mail account for you, without even asking, and make the password obvious. If you complain, we won't care. We don't have to. We're NSI."
Scary thing is, back then it was comedy. Now, it's the truth.
I just got the mail from NSI. There is no mention of a free Email account, and in fact there is no section 3.
Always keep a sapphire in your mind
Man, that would really suck for the person that admins > 100 domains, oh wait that is me ... sigh.
... oh wait I already do that via telnet->elm.
Oh well, it's not like I have nothing to do anyways, I'm glad internic created me this account, it is a true service on there part.
Now I can access my email from home, work and on the road
What ever happened to the key concept in CS 101?
KISS - Keep It Simple Stupid.
This really sucks and I'm not renewing my domains with NSI ever again - when they expire I'll register with someone else and I'll lobby to have them put on the MAPS RBL if they spam me again.
These f*ckers have screwed up before but this really takes the cake. I swear to God they've got to be working with MS on this!
--------
Oscarfish.com: tropical fish with attitude. Way t
The Mail IDs are built via how many of last names there are, and then incrementing a number like so: If there were 3 Maldas, then there are 3 accounts:
malda@...
malda1@...
malda2@...
The password is that MailID & nsi.
--
Neurowiz
You know I worked for a company (TEIR) that Jim Rutt pounded into the ground by hiring incompetent managers, making incredibly stupid business decisions and thinking the only thing a programmer or engineer wants to be happy is free beer.
Three years ago TEIR developed a Client/Server architecture that required 5 _megabyes_ of DLL's to run on a client machine. This took a year and a half to and about 80 people to develop.
After being given tens of millions of dollars and running the company into the toilet, it's amusing to see he was given another company that continually does incredibly stupid things. I wish I was an executive because there is obviously no accountability.
The worst about this thing was that as soon as I saw the e-mail, I immediately windered how many people would try to abuse this blatant security hole. It's obvious no one with two neurons to rub together was involved in this promotion at any level.
I can't wait until I can change to another company for my domain registration.
Rick
You are in a maze of twisty little passages, all alike.
Note, for last names that are consecutively numbering them. So the first the accounts are set up like this:
user: smithpass: smithnsi
user: smith1
pass: smith1nsi
user: smith2
pass: smith2nsi
user: smith3
pass: smith3nsi
user: smith4
pass: smith4nsi
Needless to say I don't consider that a good security measure either. And no, I'm not telling you what mine is numbered...
--
... to get into the networksolutions.com account ;o)
-- for undocumented cisco commands, take a peek @ dotu
Oh, and they only have authenticated web-based access for modification. I don't think they use https, though, but then again, email-based NSI updates aren't exactly secure either.
This just settles it for me. I'm never going to trust NSI with any domainnames.
---
"'Is not a quine' is not a quine" is a quine.
"'Is not a quine' is not a quine" is a quine.
Quine "quine?
Could someone post directions on how to change to a different name registrar for the domains I am already using? I know how to register new domains with the alternatives, but I want to switch my accounts over.
Thanks.
It works like this :
* Domain1 could be domain.com
* Domain2 could be domain.net
And so on...
This may not be it, but I used domain3 as my username... and got in.
When you do a whois you'll see what to use.
Regards,
Stig
Am I missing something here?
www.nsi.com/dotcomnowmail turns up a 404 for me. Same with www.networksolutions.com/dotcomnowmail. (nsi.com is just a redirector to networksolutions.com)I also looked at networksolutions.com and I cant see anthing on there about this program.
I have a domain registered with nsi (I registered when they were still at internic.net) and I have not recieved any spam from them about free web mail.
Whats the deal? Or did they fix this thing already?
-JeremyH
OTOH, this is a problem because "dotcomnow" is NSI, and NSI has a reputation for trust. Thus, there's a world of difference between "microsoft@foo.com" and "microsoft@dotcomnow.com".
Just some thoughts for figuring out how nasty this security breach is.
--The basis of all love is respect
Damn I just tried that. It does work.
/. I never would have heard about this. WTF?????
And I never even got the email from nsi.
If it wasnt for
-JeremyH
NSI is screwed up big time with this deal, and the Internet community, especially those who deal with net-abuse of this type and magnitude, does not like such a bad neighbor. Forward with full headers and apropriate password removed to MAPS RBL (http://www.mail-abuse.org) and post it to news:news.admin.net-abuse.email with the subject of NSI SPAM. Also document every phone call you've made to remove the free e-mail account and pass that along too. It's time we nip NSI in the bud about this.
---
Spammed? Click here for free slack on how to fight it!
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
Wheee! I haven't been this tempted to screw my former employer since I heard about the NT/IIS4.0 bug!
I use Macs for work, Linux for education, and Windows for cardplaying.
Since Network Solutions is handing these out based on registrars and domains, and they run the whois database, can/will they modify the whois database? Can someone with an account check this? (I don't have one, or its foo-bar).
I don't think they're allowed to, but it's their playground, so you never know.
I just guessed two usernames and passwords, (sorry, Mr. Smith numbers 83 and 84, whoever you are), put them both on vacation mode, and sent a message from one to the other. No loop.
But, I already received some spam at both accounts. Some spammer has already written a script to generate lastname### address and flood their server. I hate spam, but this is kind of funny.
I wonder how much disk space they have?
My word processor was written by Stanford Professor Donald Knuth. Who wrote yours?
I thought they were supposed to be "THE DOT COM PEOPLE." I mean my God I have just tested this and let me just say that this has to be one of the most stupid policy based security screw-ups I have ever seen.
MORONIC!!!! My 2 year old cousin has a better understanding of security concepts than these people.
Someone definitely needs a good ass chewing after implementing a policy like this one. If I were to ever write such an idiotic policy like this I would blame it on Old-timers syndrome and retire from the world of Network Security. Damn... I don't know whether to cry or laugh about this incident.
$nyper
"Help me Obi-/.-Kenobi,your my only hope!" -$
I recieve the email as well. At the bottom, they were nice *cough* enough to allow you to remove yourself from their spam list, as such:
If you do not wish to receive e-mail from Network Solutions, click on this e-mail address and type "remove" in the subject line.
PLEASE NOTE: by opting to be removed from this list we will not be able to communicate to you, in real-time, on issues regarding your account.
but of course, you by doing you, you also lose the ability to correspond with NSI altogether. Complete BS, in my opinion.
woof!
Does anyone know if they took it down, or if it was
' god damn this is one wacky game show ' ~ jay in mallrats
I got in via the alternate address and changed my settings. I would suggest doing this. Turn on vacation reply and then use this as the message.
I do not accept mail here. This account was setup
without my permission by NSI. If you need to email me
with important information please email me at the email
address listed via whois.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
All this, and it's a hundred times more stable than Windows. In other words, you should not be surprised that Windows runs at all. Every OS/2 user knows that it's possible to for an operating system to do all that Windows does (and more) and still be stable
I knew I should've stuck with Os/2 Warp back in '94.... What kind of support does IBM offer for OS/2 nowadays? OR has someone else taken over the OS? Be nice to know there is another alternative to windows out there.
Kintanon
Check out JoshJitsu.info for Brazilian Ji
I just got the email from Network Solutions (I'm a non-US customer). There's no item #3. I cannot login using my name, handle or domain name/handle.
So either they've taken it out or it's for US customers only.
Actually, it is, in some circumstances. It's called "criminal incompetence," but I don't know if there's any legal precedent in the computing industry. Anyone?
Hmm, am I the only one who finds the domain name "netSOL.com" oddly appropriate?
Anybody want to start a mailing list? If we can get about 1,000 subscribers I think we might have something here.
-- Old Man Kensey
well i guess that would work
Time to clean the mountain dew of my damn monitor now.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
Mine is a .org account -- any idea if this offer was restricted/implemented only for the .com's? I doubt it....Whether the account actually exists or not is, of course, an open question, at least until the server comes back up. :)
phil
p.s. -- I replied to the message, asking someone to contact me about the disclaimer at the end, and sending administrative and advertising information on the same list. I find this somewhat concerning, as I might skim over important info buried in a sea of "SPECIAL OFFERS". (I also don't want any more spam in my inbox than I can avoid.) I encourage other people with similar concerns to do the same.
Hey there...for all of your edification...
it's 703 742-0400
All circuits are busy now.
Luckilly, I'm being let out of my veal-fattening pen at 1 due to the hurricaine...I and my boyfriend will then jointly program our modems to do the dialing for us whilst I kick back with a Jack & water and flip the bird towards VA....
I was browsing with multiple windows this morning, and had one window fetching this article while another was fetching the floydcam piece from Tuesday. I came back after they'd finished loading, and my eyes fell on: "And for record, I regret damage done to property and life-but the power of Nature is still amazing."
Hey, can somebody give me some pointers here...
/. them for it?
(no, not *p)
I tried the link (netsol.com/blahblah)all i get is a timeout.
and the mail.dotcomnow.com gives me a login screen, but it says it failed to auth when i try the standard lastname##/lastnamensi combo. after a few tries it gives a "free web mail" page but that's it. I didn't recieve an e-mail from NSI, but I did register with them, so i'm partially worried they might have kicked me off the boat.
wtf? can't we mount (he said mount) a petition against this sort of crap? Or at least
I say we lay a corporate smack-down on them and let those roodie-poo, candy-assed NSI people know who brings them the money...
"Fuzzy Wuzzy was a bear, Fuzzy Wuzzy had no hair... Fuzzy Wuzzy wasn't fuzzy was he?"
http://mail.cotcomnow.com/ will route you to an nsi page but http://mail.dotcomnow.com/login/ will take you to the login screen...
I am a bit paranoid, I have changed passwords of eight accounts already and am considering legal action agains nsi for creating accounts under my name without my permission
Try domainid+1 and domainid+1+nsi for login and passwords, they seem to work in some instances
You should be using ssh 1.2.27, not telnet.
maybe with this someoen will finally force-rename Network Solutions to Network Problems.
One way to make sure NSI feels some pressure to fix this is for whoever managed to get microsoft, IBM, ford, gm, etc. to send an email to the real administrative contact listed in the whois database an email from this free account. Just make sure in the email that you copy the original email, and explain why this was such a bad idea.
Once the message was sent it showed a link for a "sent" folder so I clicked on the link. Yep, there was the message I had just sent. So... I click the back button on my browser and what happens? It sent my message again (I got another copy).
Then... after laughing myself silly... I got another message with the subject of "I SUCK BADLY" with text of:
Sad... really sad...
No busy signal either!!! This number was advertized at the following URL on their own site: http://www.networksolutions.com/dotcommail/email_a ccess.html but who knows how long it will be up. I called it and asked to speak to a supervisor, where I was then politely taken care of. I explained the matter of security compromise, and then politely requested the e-mail accounts to be removed for all of my domains in question.
Don't tell /. Tell NSI how stupid this whole ordeal is by filling out their "Customer [Anti-]Satisfaction Survery". I'm sure they'd love to hear from their actual customers that paid *good* monoey for NSI's services exactly what they think of those services and the people supporting them. Go ahead but be honest... :-)
If you read their service agreement, you'll notice this little gem as part of section B. REGISTRATION:
"You hereby grant NSI the right to disclose to
third parties such Account Information."
Gah! Okay, so what this means is, if you log into that account, you agree to let them release all your information to be spammed into oblivion.
Nice.
am i the only person here who does not necessarily believe this really is from internic? I mean, none of the email addresses are even internic hostnames, none of the recieved headers look like they're from internic. Since this is such publically available information, anyone could really pose as internic and mail you. Maybe I'm being naive but I don't think internic is this stupid. It's hard to believe that someone would be that stupid to try to pose as internic to get users for their free email, but I think it makes more sense that way. Here's the headers from my mail: Received: from maild.inte-net.com ([63.71.102.109]) by bilbo.w-link.net (8.9.0/8.8.5) with ESMTP id CAA05359 for ; Thu, 16 Sep 1999 02:04:59 -0700 (PDT)
Could someone answer these for me?
/. posts that its my NSI Handle.
/.ers attend this little get together, NSI may get a clue and stop being so "like, whatever..." about everything. :-)
1. What contact person did these messages go to? Billing, Technical, or Administrative?
2. Is this the same DotComNow mail that NSI is wanting to charge $169 for 2 years of service?
3. What specifically is my domainID? I'm assuming from the
4. Could someone please document the whole procedings for getting in, checking to see if you have an account, and changing the passwd?
5. Does anyone live in the Baltimore, MD area and have time this afternoon to stop by NSI's headquarters and bitch-slap the first few people you see? If enough
Thanks for the info!
Uh, don't want to say anything, but did you by chance mean to type "Test message from account!" in the SUBJECT line of the message you sent, not the CC line?
Apparently, part of the system has been shut off. I was sent the email and followed their directions; I could not log in. So I looked around a bit and found this page: There is an engine that will search by your domain name. Mine was not found, implying that my account was deactivated.
"This form will only work if you have already signed up for dot com mail. If your browser informs you that it was unable to locate the server, that means you have not signed up for dot com mail. If you would like to get dot com mail call, 1-888-642-9675."
Since they activated mine automatically and sent me a notice of this, it appears that they have shut down 1st logins.
However, that won't stop hundreds of us from attending Warpstock '99 next month, right after the Atlanta Linux Showcase.
There are rumors of Stardock taking over a small-user version of the OS/2 client. We'll know for sure this weekend. You can keep track of the OS/2 world by visiting WarpCast
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
Caveat: I haven't tried this, but I'm initiating proceedings as I type....
Apparently, register.com lets you transfer the registration of your domain from NSI to them. Check out this page. It seems to require a fax or snail-mail, but at this point, I don't really care how clumsy it is.
We just called NSI and they say someone went in and created accounts from the whois list and gave them all the "joe" passwords.... According to NSI you have to go in and actually create your own account, it is not pregenerated. But I don't see how one person would create accounts for everyone on the whois list....
01101100 01101001 01101110 01110101 01111000 01110010 01110101 01101100 01100101 01110011
http://domains.netwiz.net/, even has an antispam
policy on their main page.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
I just called the 888 number and asked to have the account removed. The first person said, "You have to respond to the 'remove' instructions at the bottom." I pointed out that that would only stop mail to my @tgeller.com account, and would not remove the dotcomnow account. "No," she said, "it does both." I asked to speak to her supervisor, and he insisted that was correct. I doubt it, but there it is. --Tom
Tom Geller
Look here or here for all sorts of other domain registrars. Screw NSI-- enough is enough. There are literally hundreds of other top-level-domains. Find one that's better, and use it.
----
We all take pink lemonade for granted.
There is no K5 cabal.
I am not the real rusty.
To those with the power to make a difference:
In an effort to retain customers, you gave them all free web email accounts. Do you even have a clue of who your customers are?
The average domain owner probably has a computer and an ISP. In many cases they will be a company that provides mail services for its employees. Others will be ISP's running huge mail servers. Many more will be website operators, who often get free email with their hosting package. At the very least they probably have a PC and an ISP that offers POP3. These people know the internet, and most of them dont want or need webmail. Those who do, probably already have it.
So, to retain customers you automatically sign them up for a service that they don't want? I simply dont understand the logic behind this. Not only that, but you break the most basic rules of security. Now you force some already annoyed sysadmins to fix a security hole that you created. Heads should roll.
Lets be honest, your company doesn't have the best reputation for customer service. Instead of blowing money on a mail server and admin costs, you could have hired more reps and made a public commitment to service. That would have made a nice little press release, and attracted some quiet praise. At the very least, it would have shown that you understand the problem, and are taking steps to fix it. Instead, you create more trouble for your customers and get bad press for technical ineptness. Go read the Cluetrain Manifesto www.cluetrain.com, clean house, and hire the clued. Otherwise, wither and die. HTH HAND
-BW
The www.dotcomnow.com site, which when I bookmarked it this morning took me to the login page, now takes me to an introduction & signup page. The original login seems to have vanished. There are now 3 different free mail domains (dotmail.com nsimail.com mymailbag.com) each with the same form, and when I try to use the id and password that worked this morning, they don't work now.
...phil
...phil
"For a list of the ways which technology has failed to improve our quality of life, press 3."
Someone, quick! Get over to NSI and take over microsoft.com!!
This is the chance we've all been waiting for! As soon as one of us Linux zealots owns microsoft.com, we can point it to linux.com!
Just a thought to make world domination more feasible.
- Shaheen
You should never take life too seriously - You'll never get out of it alive.
Holy ithoughtyouwerealltrolling.com!!
I tried my domain name but it didn't worked. Then I tried my surname after reading your post and now... well, now I'm paranoid.
Does that mean somebody has already beaten me to my domain logons, or are these mailboxes 'random'.
complain! complain!
Just out of curiousity, did NSI do this to ALL domains in their database or only to the ones that came from their services? i.e. If I registerd a domain through register.com (which I didn't) would they also add this service to that domain? Just an interesting point to consider....
- AMW
traceroute to mail.dotcomnow.com or whatever it
is revealed that it's hosted by cp.net - Critical
Path, who do kick-ass mailing services - and who
have an aggressive anti-spam policy.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
As if the username password stuff wasn't bad enough...
They sent me the spam about the free e-mail account, complete with a username/password for a domain that I have nothing to do with!
The domain was sodergren2-dom; I'm not in any of the contact information for this domain. I have nothing to do with this domain. The only connection is that I share a last name with this domain.
Don't they know how to utilize their own whois database? Maybe copyright issues prevent them from using it...
Actually,no, you're more than welcome to get a Domain name owned by another country, such as mine. [Which is for the lovely little country of Niue "nooway"] or any of a number of other countries... plus your domain info isn't available via whois, so I don't get spam from anyone [not yet anyway]
ender
Can't think of a good sig right now...
Nothing to see here
Saw this on slashdot and immediately got on the phone to NSI.
I spent 3 hours getting the runaround and being disconected with these idiots today. Was so frustrated that I went to the office in person (Herndon VA is near where I live)and asked at the desk (third floor of a pretty nice building) about the problem.
The people at the front desk don't know anything about the 'net, but offered to let me sit on hold on their phone for lord knows how long, waiting for CS.
Went home, checked mail, and yes I had a copy of the dreaded e-mail Spent another hour+ getting bounced aound, then finally got the offending account removed.
BTW, the nice chick on the phone (only nice one was the one that helped me, the last one) assured me that nobody has used these accounts yet. She was supposed to have mailed a cancellation verification to me, but it has not shown up yet.
Eve Fairbanks says I drive a hybrid!LOL
The Public and Investor Relationships contact is a Stefanie Elkins (415-344-5503) selkins@cp.net.
Their "Email Solutions for Proprietary/Groupware Systems" toll free number is 1-800-826-4666. I'll call THEM and ask them to remove any knowledge of my domains from their system... and remind them that I'm a Washington State Resident and we don't like spam. We have a nice anti-spam law here.
-- I have a private email server in my basement.
here is what the bottom of that email states: "If you do not wish to receive e-mail from Network Solutions, click on this e-mail address and type "remove" in the subject line. PLEASE NOTE: by opting to be removed from this list we will not be able to communicate to you, in real-time, on issues regarding your account." eh? i'm screwed if i did, screwed if i don't!
Your friendly bank does not send you an unsolicited credit card because the courts (at least in the US) have held the contract is unenforcable. One concern was that credit cards could be stolen from the mail without the person's knowledge, and if the card was unexpected and from an unknown company the consumer/victim would have absolutely no clue there was a problem. A second concern was that many people would not be familiar with credit cards (in the 60's, as I recall) and they could incur substantial liabilities without realizing it.
They can, and do, send you "preapproval" letters that only require you to confirm some information and sign it. Someone can still steal these letters and forge you signature, but theft and forgery are already crimes.
It is legal for a company to issue you a replacement card without prior notice, but it runs the risk of pissing off customers. A bank manager quietly told me that a full third of the customers, including myself, closed our accounts after our bank was bought out and the new bank decided to issue "debit cards" (pre loss caps) to replace "atm cards" without prior notice or consent. It was rude, crude, and socially unacceptable, but legal.
Back to the "generous" NetSol offer, I am outraged. And not just because they keep making me these wonderful offers yet are incapable of changing my contact informaton despite repeated requests.
The currency on much of the net today is reputation, and NetSol's indifferent disregard to the consequences of its actions is as shocking to our sensibilities as the 60's banks disregard to the consequences of it's far-too-open credit card policy was to their peers. Of course nobody should automatically assume that the NetSol accounts are actually controlled by the person whose name appears on them, but a lot of people will. Unlike most (all?) other free mail sites, NetSol accounts can be tied to real names, real addresses and real phone numbers. So they have *far* more intrinsic credibility than "HotMail" or "GeoCities."
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken