Feeds

Panix.com hijack: Aussie firm shoulders blame

Loopholes, errors, and weekends off

  • alert
  • submit to reddit

Boost IT visibility and business value

An Australian domain registrar has admitted to its part in last weekend's domain name hijack. of a New York ISP. Melbourne IT says it failed to properly confirm a transfer request for the Panix.com domain.

Ed Ravin, a Panix system administrator, says the Melbourne IT error enabled fraudsters using stolen credit cards to assume control of the domain. Thousands of Panix.com customers lost email access for the duration of the occupation, and many emails will never be recovered.

The mistake was compounded by the unavailability of Melbourne IT staff over the weekend - the company rectified its mistake late on Sunday evening, US time. Speaking to ComputerWorld Ravin said he was unable to contact anyone in support at Melbourne IT until the company's offices opened on Monday morning.

Bruce Tonkin, Melbourne IT's CTO, offered the following explanation:

"In the case of Panix.com, evidence so far indicates that a third party that holds an account with a reseller [UK based Fibranet] of Melbourne IT, fraudulently initiated the transfer. The third party appears to have used stolen credit cards to establish this account and pay for the transfer. That reseller is analysing its logs and cooperating with law enforcement."

A loophole that allowed the error, that caused the problem has now been closed, he added.

The roots of the affair lie in new rules governing the transfer of domain name ownership. These rules, which came into effect last November, mean that inter-registry transfer requests are automatically approved after five days unless countermanded by the owner of a domain.

When ICANN proposed the new procedures, many in the industry warned that as well as making it easier to move domains around, the change would make it easier for people to hijack domains. Network Solutions, for example, took the precautionary step of locking all its customers' domains. Panix.com says its domain name was locked, and that despite this, it was still transferred. ®

Related stories

Panix recovers from domain hijack
Katie.com lawyer to host cyber-bullying conference
eBay domain hijacker arrested

Secure remote control for conventional and virtual desktops

More from The Register

next story
Déjà vu: Virgin Media jacks up broadband prices
Screw copper phone lines, we're UNIQUE, bleats telco
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
Fifteen zero days found in hacker router comp romp
Four routers rooted in SOHOpelessly Broken challenge
New Sprint CEO says he will lower axe on staff – but prices come first
'Very disruptive' new rates to be revealed next week
US TV stations bowl sueball directly at FCC's spectrum mega-sale
Broadcasters upset about coverage and cost as they shift up and down the dials
UK mobile coverage is BETTER than EVER, networks tell Ofcom
Regulator swallows this line and parrots it back out at us. What are they playing at?
What's the nature of your emergency, Vodafone?
Oh, you've dialled the wrong number for ad fibs, rules ASA
EE network whacked by 'PDP authentication failure' blunder
Carrier is 'aware' of cockup, working on a fix NOW
ROAD TRIP! An FCC road trip – Leahy demands net neutrality debate across US
You crashed watchdog's site, now time to crash its ears
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?