Renewal Notification Headache: It can be quite frustrating when your domain name is on the verge of expiring, bombarded with emails from unfamiliar registrars pressuring you to renew with them. Some may even falsely claim you owe them money for previously registering the site on your behalf. Dealing with certificates and, if you’re lucky, DNS configurations can add to the ordeal. The same goes for sites that play a crucial role in verifying site ownership, email legitimacy, and TLS/SSL certificates. If the ownership of one of these domains expires due to negligence or a migration to a different domain, the consequences can be dire.

Recent Incident: A recent incident involved dotmobilregistry.net, which previously served as the WHOIS authority for .mobi sites, signifying mobile-optimized websites. The domain was transitioned to whois.nic.mobi while the ownership of the old site was allowed to lapse. Consequently, numerous devices continued to query the outdated site during traffic verification.

Ownership Seizure: A security researcher noticed this oversight and seized control of dotmobilregistry.net for a mere $20. With this power, he had the ability to manipulate the 2.5 million queries from approximately 135,000 distinct systems over a few days. This opened up opportunities to create counterfeit TLS/SSL certificates, monitor emails, and even deceive these systems into executing malicious code during the traffic verification process—a concerning scenario.

Thankfully, the researcher opted to display ASCII art to the querying systems and transferred ownership to a security firm for safe management. Such incidents have transpired before and are likely to occur again, underscoring the importance of staying vigilant.

Source: https://pcper.com/2024/09/how-to-take-over-almost-every-mobi-site-for-20/