For Just $20, Researchers Seize Part of Internet Infrastructure

Their findings highlight the frailty of some of the mechanisms for establishing trust on the Internet.

Security researchers ability to gain control of a chunk of the Internets infrastructure for a mere $20 has focused attention on the fragility of the trust and cybersecurity mechanisms that organizations and users rely on daily.
The troubling event began with researchers at watchTowr on a whim looking for remote code execution vulnerabilities in WHOIS clients while at the recent Black Hat USA conference in Las Vegas. In poking around, the
researchers discovered
that the WHOIS server for the .mobi top level domain (TLD) — for mobile-optimized sites — had migrated a few years ago from whois.dotmobiregistry.net to whois.nic.mobi. After the change, the registration for the original domain (whois.dotmobiregistry.net)
expired last December
.
A WHOIS server is like a public phone book for the Internet and contains information on the owners of an IP address or website along with lots of other related information. A WHOIS client is a tool that queries for and retrieves information about a specific domain name or IP address from a WHOIS server.
On a lark, the watchTowr researchers spent $20 to register the expired whois.dotmobiregistry.net in the companys name and stick a WHOIS server behind it to see if any WHOIS clients would query it. Their initial presumption was that few, if any, WHOIS clients would still touch the decommissioned server after the migration to the new .mobi authoritative WHOIS server (whois.nic.mobi) a few years ago.
To their surprise — and consternation — watchTowr researchers found over 76,000 unique IP addresses sending queries to their WHOIS server in just a couple hours. In about two days that number had ballooned to over 2.5 million queries from 135,000 unique systems worldwide.
Contrary to their expectations, among those querying watchTowrs WHOIS server were major domain registrars and websites performing WHOIS functions. Also querying watchTowrs WHOIS domain were mail servers for numerous government organizations in the US, Israel, Pakistan, India, the Philippines, a military entity in Sweden, and countless universities worldwide. Troublingly, even some security-related websites, including VirusTotal, queried watchTowrs WHOIS server as if it were the authoritative server for the .mobi TLD.
Had watchTowr been a bad actor, they could have easily abused their status as the owner of whois.dotmobiregistry.net to deliver malicious payloads to anyone querying the server, or to passively monitor email communications and potentially create other mayhem.
In the wrong hands, owning the domain could enable attackers to respond to queries and inject malicious payloads to exploit vulnerabilities in WHOIS clients, watchTowrs CEO and founder Benjamin Harris said in a FAQ on his companys discovery. From the standpoint of government mail servers reaching out to watchTowrs WHOIS servers, traffic analysis can be performed to passively observe and infer email communication, he said.
But even more troubling than that was watchTowr’s discovery of multiple Certificate Authorities (CA) — including those issuing TLS/SSL certificates for domains such as ‘microsoft.mobi and ‘google.mobi — using watchTowr’s server for domain verification purposes.
It turns out that a number of TLS/SSL authorities will verify ownership of a domain by parsing WHOIS data for your domain— say watchTowr.mobi — and pulling out email addresses defined as the administrative contact, watchTowr said. The process is to then send that email address a verification link. Once clicked, the certificate authority is convinced that you control the domain that you are requesting a TLS/SSL cert for, and they will happily mint you a certificate.
In other words, watchTowr could provide its own email address to certificate authorities (CAs) in response to domain ownership queries and obtain TLS/SSL certificates on behalf of other organizations. Once again, contrary to expectations, watchTowr discovered multiple well known CAs — including Trustico, Comodo, GlobalSign, and Sectigo — using WHOIS data for domain verification.
For microsoft.mobi, watchTowr demonstrated that CA GlobalSign would parse responses provided by its WHOIS server and present [email protected] as an authoritative email address, the security vendor said. watchTowrs discovery effectively undermines the certificate authority process for the entire .mobi TLD, a process that has been targeted by nation-states overtly for years. The research highlights the
trivial loopholes
in the Internets TLS/SSL vital encryption processes and structures and shows why trust in them is misplaced at this stage, the researchers wrote.
Nick France, CTO at Sectigo, says the issue has to do with CAs being allowed to use administrative emails on public WHOIS records for domain names. However, the researchers found that the .mobi registry had changed their WHOIS server in the past and the old name was now available as a registerable domain name — which they did, France says.
This is only a problem if a CA uses an outdated list of WHOIS server, he says. In that event, a CAs WHOIS query could get directed to an outdated server and any attacker that owns it could send any output in response, including an email address of their choice. This leads to a failure of the domain verification process and thus mis-issued certificates.
The issue that watchTowr discovered highlights why CAs must keep their systems updated, especially with respect to critical processes like domain control validation, French says. WHOIS is an old, insecure system — often neglected by researchers and users alike, leaving it primed for the discovery of flaws like this one, he notes.
While it may impact only smaller TLDs like .mobi, as opposed to .com, .net, and .gov, it still demonstrates a serious vulnerability in the domain verification process, he says.
Tim Callan, Sectigos Chief Experience Officer, adds how the incident highlights a need to update some of the rules around Domain Control Validation (DCV). We should expect the Certification Authority Browser Forum to move quickly on these changes in order to plug this particular hole.
In the meantime, the nonprofit Internet monitoring entity ShadowServer has sinkholed the dotmobiregistry.net domain and the whois.dotmobiregisry.net hostname and is redirecting all queries to the server to the legitimate WHOIS responsible for .mobi domains. If you have code/systems still using the expired
http://whois.dotmobiregistry.net
to make WHOIS queries for the .mobi TLD, please update immediately to use the correct authoritative WHOIS server
http://whois.nic.mobi
, said Piotr Kijewski, ShadowServers CEO in an email.
Dont miss the latest
Dark Reading Confidential podcast
,
where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa and forced to spend the night in jail -- just for doing their pen-testing jobs.
Listen now!

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
For Just $20, Researchers Seize Part of Internet Infrastructure