Registrar's database said to have exposed data

A database problem with a major US domain registrar exposed sensitive financial and personnel information.
  • (IDG News Service)
  • — 10 April, 2006 10:19

A database problem with a U.S. domain name registrar exposed sensitive financial and personal information relating to thousands of domain name registrations, a Dutch company said Friday.

DiscountDomainRegistry.com, of New York, fixed the problem shortly after being notified Thursday, said Nico Vandendries, chief executive officer of Strongwood, a private investigation company based in the Netherlands.

DiscountDomainRegistry.com Chief Executive Officer Alex Brecher said that the company is 100 percent positive customer data was not compromised. The "alleged vulnerability," he wrote, was patched within minutes after the company was contacted by Strongwood.

"We're in the midst of investigating these allegations, and we cannot provide detailed information at this time," Brecher wrote.

Erik Ekkelenkamp, a system project engineer with Strongwood, was researching .eu domain names when he clicked a link within DiscountDomainRegistry's site. The link led to an error involving execution rights on a MySQL directory. MySQL is a widely used open-source database program.

A script plus other programming usually unseen was visible that allowed for a connection to the database, which contained credit card numbers, usernames, passwords and other information, Vandendries said.

A DiscountDomainRegistry.com official wasn't initially convinced there was a problem, Vandendries said.

"At first, they didn't believe us until we presented him with his own password," Vandendries said. "And then he knew we were in."

On its Web site, DiscountDomainRegistry.com, founded in 1998, says it registers domain names for US$14.99 per year, including those of Fortune 500 companies.

So far, it's believed no one has exploited the error, which may have existed for up to four months, Ekkelenkamp said. DiscountDomainRegistry.com had changed parts of its Web site recently, which may have resulted in the bug, he said.

The damage could have been severe, Vandendries said. The credit card data and personal information from DiscountDomainRegistry.com clients could have been sold, he said.

Further, access to usernames and passwords would have allowed an intruder to change the names and IP (Internet Protocol) addresses associated with Web sites, a method used for so-called "phishing" scams, Vandendries said.

Phishing involves tricking users into visiting a Web site that appears legitimate but actually is a facade. The URL (uniform resource locator) may look authentic but connects to an IP address with a bogus Web site.

The fraudulent Web sites usually have forms for providing sensitive material, such as financial information, which is then directly sent to scammers.

Vandendries estimated it would take "little skill" with MySQL to exploit the bug. "If a bad guy found this leak and had access to the database ... then I'm sure it could have cost millions."

Ekkelenkamp said he received a call last night from the owner of DiscountDomainRegistry.com thanking him.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Compare & Save

Deals powered by WhistleOut
WhistleOut

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?