Rogue WHOIS server gives researcher superpowers no one should ever have | Ars Technica
arstechnica.com/security/2024/09/rogue-whois-server-gives-researcher-superpowers-no-one-should-ever-have
What Jamie wrote
This is a pretty incredible story and I’m surprised that there is no cryptographic signing requirements for a WHOIS server like this. In this case this researcher simply setup a WHOIS server where one previously was and a bunch of things just trusted it because it was there!
To Harris’s surprise, his server received queries from slightly more than 76,000 unique IP addresses within a few hours of setting it up. Over five days, it received roughly 2.5 million queries from about 135,000 unique systems. The entities behind the systems querying his deprecated domain included a who’s who of Internet heavyweights comprising domain registrars, providers of online security tools, governments from the US and around the world, universities, and certificate authorities, the entities that issue browser-trusted TLS certificates that make HTTPS work.
It seems wild that such a critical function wouldn't require some form of certificate to prove it is valid.
Same host · 187 links from arstechnica.com
- Reviewing iOS 18 for power users: Control Center, iCloud, and more | Ars Technica
- Vaporizing plastics recycles them into nothing but gas | Ars Technica
- Google calls for halting use of WHOIS for TLS domain verifications | Ars Technica
- NIST proposes barring some of the most nonsensical password rules | Ars Technica
- Your doctor’s office could be reading your blood pressure all wrong - Ars Technica