{"id":19267,"date":"2015-02-12T03:00:54","date_gmt":"2015-02-12T08:00:54","guid":{"rendered":"https:\/\/webhostinggeeks.com\/blog\/?p=19267"},"modified":"2021-10-19T06:51:38","modified_gmt":"2021-10-19T10:51:38","slug":"can-your-domains-get-hijacked","status":"publish","type":"post","link":"https:\/\/webhostinggeeks.com\/blog\/can-your-domains-get-hijacked\/","title":{"rendered":"Can Your Domains Get Hijacked?"},"content":{"rendered":"

Imagine this scenario: your customer service line gets a call from the owner of a small business whose e-commerce website is hosted through your service. The owner is in a panic. After months of steady visitor traffic and consistent daily transactions, suddenly all visits to her site have stopped. Not knowing what do to next, she now turns to you for help.<\/p>\n

<\/p>\n

After a little bit of investigating, you discover that someone has unlawfully accessed your domain control panel by impersonating her company\u2019s administrative contact, modified the Domain Name System (DNS)<\/a>, and transferred her domain name to a different server. You\u2019re now placed in the unenviable position of informing her that her domain has been hijacked.<\/p>\n

Sound implausible? Such attacks have actually happened, with some even targeted at high-level companies listed on enterprise-class domain registries. While not as common as the threats posed by viruses and malware, domain hijacking can be equally as devastating to an individual customer\u2019s financial stability and your reputation as a web host. The process of recovering a hijacked domain through logging a dispute through the Internet Corporation for Assigned Names and Numbers<\/a> (ICANN) be costly as well, with many customers simply choosing to register a new domain name in the end (most likely through another web host).<\/p>\n

Who\u2019s Responsible for Domain Security?<\/h2>\n

The common line of thinking is that the responsibility of protecting a domain name lies with the customer who registers it, and that a compromise of security to that name is the result of poor monitoring on their part. Yet in the wake of investigations into the hijacking of the domains of some very prominent sites, ICANN\u2019s Security and Stability Advisory Committee (SSOC) identified failures on the part of both domain name registrants and the registrars with whom they had worked as being responsible for the incidents. Plus, from a customer perspective, they pay you for secure web services. In their minds, that includes the safety of their domain names.<\/p>\n

Domain Hijacking Explained<\/h2>\n

In order to properly understand how you might be able to prevent your customers\u2019 domains from being hijacked<\/a>, it helps to first understand the process of how a hacker can actually hijack a domain. What\u2019s most important to understand is that an attacker doesn\u2019t need to access your web server in order to get at a domain. Rather, hijackings occur via a backdoor route through the customer\u2019s actual contact email address.<\/p>\n

Here\u2019s how the entire hijacking process works:<\/p>\n

    \n
  1. The attacker goes to whois.domaintools.com and searches for the target domain name. Under the Whois Record, he or she gets the customer\u2019s administrative contact email address.<\/li>\n
  2. Searching the same record, the attacker finds the domain registrar (your web hosting service, in this case) under the \u201cRegistered through:\u201d field. If that information is not recorded there, he or she can simply find the ICANN Registrar listed under the \u201cRegistry Data\u201d heading.<\/li>\n
  3. With access to the administrative email address, the attacker simply needs to hack into that email account.<\/li>\n
  4. Having control of the customer\u2019s administrative contact email, the attacker then visits your website and chooses the \u201cForgot Password\u201d option in the login portal. He or she then enters either the actual domain name or the administrative email address to reset the password.<\/li>\n
  5. An email is sent to the administrative contract address with instructions on resetting the password. The attacker creates a new password on the domain control panel, and now has full control of the domain.<\/li>\n
  6. Within a mere matter of minutes, the attacker redirects the domain to his or her web server.<\/li>\n<\/ol>\n

    Because your system recognizes the attacker as the customer\u2019s administrative contact, the hijacking often isn\u2019t discovered until the customer notices an abrupt halt to his or web traffic and\/or email correspondence. By that time, the amount lost in customer transactions coupled with the expenses required to fix the problem can be enormous.<\/p>\n

    What You Can Do<\/h2>\n

    Recognizing the vulnerabilities inherent with the domain registration process, the SSAC highlighted several measures that both domain name registrants and registrars can do to help mitigate the threat of a hijacking. As a registrar, following these recommendations could help provide your customers with the peace-of-mind needed in order to trust their domains to your care. These recommendations include:<\/p>\n