So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all registrar locking protections)

As the answer of that question wasn’t descriptive on wheather this depict a real threat, I finally reported the issue to their security team (plus an another bug that might enable to perform the theft from their own registrar website).

However, came up the killer’s question from their part :how would it be possible to update contact details ?
I don’t have even an idea of the involved protocols in such registrar transferring…

  • 1
    Historically? Fax. This is modern day, though, so I've no doubt people are doing it via tumblr or flickr or something else with no e. – gowenfawr Feb 2 '16 at 15:26
  • @gowenfawr of course the aim is to answer the security team question's. – user2284570 Feb 2 '16 at 15:27
  • then the answer is "social engineering and alternate channels" (which is what I said, but with less flippancy). Unfortunately, I can't make it descriptive, so it's a comment not an answer. – gowenfawr Feb 2 '16 at 15:30
  • @gowenfawr ok but what i need is to understand the technial part, so I can understand what would differ from doing the same with a protection. Because social engineering targetting who: the current registrar staff? – user2284570 Feb 2 '16 at 15:36
  • 1
    For your homework, assess the weaknesses of this process: Register.com Email Address Change Form – gowenfawr Feb 2 '16 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.