Latest news of the domain name industry

Recent Posts

NetSol to alert cops over domain hijacking

Network Solutions intends to “notify the proper authorities” after a high-profile customer had his account hijacked over the weekend.

Stephen Toulouse, head of policy and enforcement for Microsoft’s Xbox LIVE, lost access to stepto.com, including his web site and email, for several hours yesterday, after a disgruntled teenaged gamer persuaded a member of NetSol’s support staff to hand over the account.

In a statement published on its blog, the domain name registrar said it was an “isolated incident directed at a specific customer account”, adding:

We maintain a well developed processes to ensure that Social Engineering attempts or any identified security concerns are immediately alerted to a Supervisor, who will expedite the investigation, usually with the help of the Network Solutions Security team. In this case, the procedure was not followed, and we apologize for any trouble caused to our customer.

Our Security team continues to investigate this matter. Additionally, because we take this matter very seriously, we intend to notify the proper authorities with the evidence that we have gathered, so that they may investigate the person(s) responsible for the fraud.

According to a new YouTube video released by the person claiming responsibility for the attack, “Predator”, he’s 15. He blamed Toulouse for his frequent Xbox LIVE bannings.

While he said he perpetrated the attack to highlight insecurities in Xbox LIVE, he also offered to hijack other gamers’ accounts for up to $250.

Comments posted in response to his first post-attack video claim to reveal his true identity, but of course comments on YouTube are not what you’d call reliable evidence.

The video itself does reveal a fair bit of information, however, so I can’t imagine tracking him down will be too difficult, especially if Microsoft has his parents’ credit card number on file.

His YouTube channel also has videos of him operating a botnet. That’s a whole lot more serious.

Xbox security chief gets domain hijacked

The head of Xbox Live policy and enforcement at Microsoft has had his domain name compromised by a disgruntled gamer using a social engineering attack on Network Solutions

Stephen Toulouse, who goes by the screen name “Stepto” and has the domain stepto.com, seems to have also lost his email, hosting and, as a result, his Xbox Live account.

He tweeted earlier today: “Sigh. please be warned. Network solutions has apparently transferred control of Stepto.com to an attacker and will not let me recover it.”

Somebody claiming to be the attacker has uploaded a video to YouTube showing him clicking around Toulouse’s Xbox account, whilst breathlessly describing how he “socialed his hosting company”.

It’s a bit embarrassing for Toulouse. He was head of communications for Microsoft Security Response Center for many years, handling comms during worm outbreaks such as Blaster and Slammer.

Now at Xbox Live, he is, as the attacker put it, “the guy who’s supposed to be keeping us safe”.

But it’s probably going to be much more embarrassing for Network Solutions. When the tech press gets on the story tomorrow, difficult questions about NSI’s security procedures will no doubt be asked.

Toulouse has already made a few pointed remarks about the company on his Twitter feed today.

Social engineering attacks against domain name registrars exploit human, rather than technological, vulnerabilities, involving calling up tech support and trying to convince them you are your victim.

In this case, hijacking the domain seems to have been a means to control Toulouse’s email account, enabling the attacker to reset his Xbox Live password and take over his “gamer tag”.

The same technique was used to compromise the Chinese portal Baidu.com, that time via Register.com, in late 2009. That resulted in a lawsuit, now settled.

The attacker, calling himself Predator, was apparently annoyed that Toulouse had “console banned” him 35 times, whatever that means.

He seems to have left a fair bit of evidence in his wake, and he appears to be North American, so I expect he’ll be quite easy to track down.

Predator’s video, which shows the immediate aftermath of the attack, is embedded below. It may not be entirely safe for work, due to some casually racist language.

UPDATE (April 5): The video has been removed due to a “violation of YouTube’s policy on depiction of harmful activities”. I snagged a copy before it went, so if anybody is desperate to see it, let me know.

Network Solutions will sell .xxx domains

Kevin Murphy, January 14, 2011, Domain Registrars

Network Solutions has become the first big-name registrar to show that it will support the proposed .xxx top-level domain.

This page has recently appeared on the NSI site, accessible from the company’s home page through the link “.xxx Coming Soon”.

NSI appears confident that ICANN will approve the TLD soon:

.XXX will be launching shortly and Network Solutions is working with ICM Registry to provide informational services for our customers that wish to take advantage of the launch and register domain names.

The TLD is currently being tied up by ICANN’s Governmental Advisory Committee, but many believe it’s likely to be a shoo-in at the San Francisco meeting in March or sooner.

Go Daddy-Google group targets bogus pill merchants

Kevin Murphy, December 15, 2010, Domain Policy

The newly forming industry body tasked with taking down web sites selling fake pharmaceuticals plans to meet next month to develop its mission statement and charter, according to Go Daddy general counsel Christine Jones.

Jones said in an interview tonight that the group, which Go Daddy is jointly “spearheading” with Google, is likely to meet in Phoenix, Arizona in the third week of January.

As I blogged earlier today, the organization was formed following a series of meetings at the White House, which has a policy of reducing counterfeit drugs sales online.

Domain name companies including Go Daddy, eNom, Neustar and Network Solutions are joined in the currently nameless non-profit by the three major search engines and all the major payment processors.

Jones confirmed that redirecting a domain name is an action a participating registrar could take if it finds an infringing site. Go Daddy and others already do this in cases of child porn, for example.

But the group will also share information about fake pharma sites so Google, for example, would also be able to block them from search and Visa could stop payments being processed, Jones told me.

The White House meetings were organized by Victoria Espinel, the administration’s Intellectual Property Enforcement Coordinator (IPEC).

So, while the group has yet to formalize its policies, I wanted to know what the prevailing opinion is on how “illegal” a site will have to be before the group will try to take it down.

Taking down a site selling sugar pills or industrial acid as HIV treatments is one thing, killing a site selling genuine medications to people without prescriptions is another, and blocking a legit pharmacy that sells drugs to Americans with prescriptions more cheaply from across the Canadian border is yet another.

Jones said: “If a pharmacy is a licensed pharmacy and is abiding by whatever the state rules are wherever they’re located, that’s not our target.”

Apparently the new organization, which will be formed as a non-profit entity, may help the companies to avoid running afoul of ECPA, the US Electronic Communications Privacy Act.

Jones said that other companies participating in the White House meetings still have not decided whether to join the new group or not. End-of-year budgetary issues may be a factor here.

Domain registrars have come in for considerable flak over 2010 for allegedly not doing enough to counter fake pharma sites.

A Knujon report published in May, and others, eventually led to eNom in particular promising to crack down harder on rogue pharmacies.

Go Daddy proposes fake pharma site shutdown body

Kevin Murphy, December 15, 2010, Domain Policy

A cross-industry body that will make it easier for web sites selling fake drugs to be shut down is forming in the US, led by Google and Go Daddy.

The idea for the currently nameless organization was announced yesterday following a series of meetings between the internet industry and White House officials.

The group will “start taking voluntary action against illegal Internet pharmacies” which will include stopping payment processing and shutting down web sites.

The domain name business is represented by the three biggest US registrars – Go Daddy, eNom and Network Solutions – as well as Neustar (.biz, .us, etc) on the registry side.

Surprisingly, VeriSign (.com) does not appear to be involved currently.

Other members include the major credit card companies – American Express, Visa and Mastercard – as well as PayPal and search engines Google, Microsoft and Yahoo.

According to a statement provided by Neustar:

GoDaddy and Google took the lead on proposing the formation of a private sector 501(c)(3) non-profit organization that would be dedicated to promoting information sharing, education, and more efficient law enforcement of rogue internet pharmacies.

It’s early days, so there are no specifics as yet as to how the organization will function, such as under what circumstances it will take down sites.

There’s no specific mention of domain names being turned off or seized, although reading between the lines that may be part of the plan.

There’s substantial debate in the US as to what kinds of pharmaceuticals sites constitute a risk to health and consumer protection.

While many sites do sell worthless or potentially harmful medications, others are overseas companies selling genuine pharma cheaply to Americans, who often pay a stiff premium for their drugs.

The organization will do more than just shut down sites, however.

It also proposes an expansion to white lists of genuine pharmacies such as the National Association of Boards of Pharmacies’ Verified Internet Pharmacy Practice Sites (VIPPS).

And it will promote consumer education about the “dangers” of shopping for drugs online, as well as sharing information to stop the genuine bad guys “forum shopping” for places to host their sites.

This is what the statement says about enforcement:

The organization’s members agree to share information with law enforcement about unlawful Internet pharmacies where appropriate, accept information about Internet pharmacies operating illegally, and take voluntary enforcement action (stop payment, shut down the site, etc.) where appropriate.

While taking down sites that are selling genuinely harmful pills is undoubtedly a Good Thing, I suspect it is unlikely to go down well in that sector of the internet community concerned with the US government’s increasing role in removing content from the internet.