Re - Security loopholes in Mail Templates

From: Jason Tarrant (jasont@internetcds.com)
Date: Fri Jun 02 2000 - 17:39:57 EDT


I wish to clarify a post that I made earlier re. fake mail from
modifications and a loophole that I have seen exploited previously. I am
also cc-ing this to the Open SRS discussion list.

I have no desire to spawn a good idea so that you can exploit it, or
condone the information that I pointed out. I also made a tongue in cheek
comment at the end of my post re. NSI and what many of us would like to see
happen to them, which stems from many dealings with NSI in my tenure as
Domain Admin here. Most have been positive, but I have also had numerous
instances that were far from positive, and one incident last years that was
very nearly litigious.

The point of my post earlier to Open SRS and its followers and the
subsequent post by Phillipe Landau was to hopefully open some eyes. I used
to love the ease of use of the e-mail template to modify domain records, it
made my job effortless. But in recent months we have seen the loopholes
that have been waiting for exploitation by pirates now that domain names
are becoming scarce and indeed, prized and valuable commodities.

The Key is for NSI to figure out how to protect ours, yours, and the
millions of customers we serve, domain registrations, and if lo and behold
a pirate does attack a domain name, there needs to be instant punitive and
restorative action taken by NSI or Open SRS or any other registrar involved
for that matter. I personally called Web.net today and gave them a tidbit
of advice on how to ensure a fax modification gets processed expediently,
because they have been treated like they were the crooks by NSI, while some
vandal, crook, scum bag, call him what you will, pees his pants laughing
the other side of the world as NSI wrings its hands and tries to apportion
blame elsewhere.

Sorry for the rant, but NSI needs to be mindful that the customers are
everything, without this intangible product called a registration, there is
no NSI and they need to start treating their customers like customers, not
like annoying problems who can be fobbed off and passed around NSI like a
football, while nobody deals with the problem at hand. Its happened to me
too many times, and I'm sure many of you, and its this which is fostering
this attitude towards NSI.

Shape it up, take stock of your customers complaints and concerns, act
promptly, and courteously, and don't try to apportion blame, just fix the
issues, or you will ultimately lose the very business that made you what
you are.

Jason Tarrant
Domain Administrator
InternetCDS
1-800-943-4638 xtn. 2330
541-955-0805
www.internetcds.com



This archive was generated by hypermail 2.1.3 : Tue Oct 19 2004 - 23:35:37 EDT