Bureaucrats, staff, Administrators
8,157
edits
Changes
7th DNS Seal wiki article.
{{Glossary|
|note = '''This information is brought to you by<br> [http://dnsseal.wiki/ DNS Seal], a best practices wiki for DNS.'''
| logo = DNS Seal.png
|link = http://dnsseal.wiki/
}}
'''Domain Name Hijacking''' or Domain Hijacking refers to the security breach that occurs when an outside agent, such as a hacker, gains control over a domain registered to another individual or organization.<ref name="report">[http://archive.icann.org/en/announcements/hijacking-report-12jul05.pdf Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions] (PDF), ICANN's SSAC</ref><ref name="go">[http://www.gohacking.com/how-domain-name-is-hijacked-how-to-protect/ How a Domain Name is Hijacked and How to Protect it] by Srikanth Ramesh, GoHacking.com</ref> Hijacking can be accomplished via various practices and often results in domain name registrants losing control of their domains as traffic is redirected to a different site, the content of the original site is changed, or the outside agent switches the control of the name through the registrar. <ref name="go"/> This practice has reportedly tripled since 2005 and is related to [[Reverse Domain Name Hijacking]]<ref name="cio">[http://www.cio.com/article/699206/4_Ways_to_Prevent_Domain_Name_Hijacking_?page=1&taxonomyId=3089 4 Ways to Prevent Domain Name Hijacking] by Meridith Levinson (February 1, 2012), CIO</ref>
==Public Perception==
Domain name hijacking is viewed negatively by most people and can be referred to as domain theft.<ref name="go"/>
==Outcome==
The broader outcome of this behavior is that users' domain names are at risk from predatory parties. Individuals can lose control of their domain names and larger organizations can face major losses, monetarily and in consumer confidence.
==Historical Use==
Domain name hijacking has been used for a number of purposes, such as "malice and monetary gain."<ref name="report"/> If the hijacked site deals with Internet commerce or retail, for example, its users may be redirected to a [[phishing]] webpage designed to steal their financial information.<ref name="cio"/> A domain name is vulnerable to hijacking through a number of different avenues:
*DNS Servers: if the DNS is hijacked or poisoned, people typing in a domain name may be redirected to another page without their knowledge.<ref name="cio"/> This method does not require any registrant account information to be compromised or readily available. See [[Pharming|DNS Hijacking]] for more information.
*Registrar Security: if a registrar's security is compromised and a domain name is not locked, it could be transferred to a different user and registrar before the owner is notified.<ref>[http://www.theregister.co.uk/2005/07/12/icann_domain_hijacking/ ICANN warns world of domain hijacking] by Kieren McCarthy (July 12, 2005), The Register</ref>
*Email Security: a third party can use WHOIS to find information about a registrant, such as a personal email account, and once the email account is compromised, use it to request a new password from the registrar.<ref name="go"/><ref name="cio"/> If the third party gains access to the registrant's account with its registrar, it can change primary ownership and notification information.
*Phishing: an outside agent can pose as a representative of the registrar and ask for log-in information directly.<ref>[http://www.ehow.com/how_8743588_recover-hijacked-domain.html How to Recover a Hijacked Domain] by James Johnson, eHow.com</ref>
==ICANN Policy==
*[[Transfer of Registrations between Registrars Policy]]: This policy requires that registrars send registrants an authorization/confirmation notice when domain names are going to be transferred and that registrants reply in a secure way.<ref>[http://www.icann.org/en/resources/registrars/transfers/policy-15mar09-en.htm Policy on Transfer of Registrations between Registrars | In effect until 31 May 2012], Internet Corporation for Assigned Names and Numbers (ICANN)</ref>
*[[Registrar Transfer Dispute Resolution Policy]]: This policy outlines how registrars deal with transfer disputes, including unauthorized transfers.<ref>[http://www.icann.org/en/help/dndr/tdrp Registrar Transfer Dispute Resolution Policy], Internet Corporation for Assigned Names and Numbers (ICANN)</ref>
**Note: It can be challenging to prove to registrars that a domain name has been hijacked as "Registrars are often skeptical of claims of domain hijacking."<ref name="help">[http://www.circleid.com/posts/help_domain_name_hijacked/ Help! My Domain Name Has Been Hijacked!] by Brett Lewis (January 12, 2007), CircleID</ref>
==Legislation==
There is no U.S. legislation that directly addresses domain name hijacking. However, as it potentially can involve theft, fraud, identity theft, and phishing, there are avenues for legal redress. It is worth noting that proving domain name ownership after being hijacked can be difficult.<ref name="help"></ref>
==Additional Resources and Tips==
*Read ICANN's Report on [http://archive.icann.org/en/announcements/hijacking-report-12jul05.pdf Domain Name Hijacking] for a brief overview of domain name hijacking and a thorough account of notable domain hijacking incidents
*View [http://www.ehow.com/how_8743588_recover-hijacked-domain.html How to Recover a Hijacked Domain]
*View ICANN's [http://www.icann.org/en/resources/registrars/transfers/foa-conf-12jul04-en.htm Standardized Authorization Form] required to transfer domain names from one registrar to another
*For tips on how to prevent domain name hijacking, read [http://www.circleid.com/posts/help_domain_name_hijacked/ Help! My Domain Name Has Been Hijacked!]
==Related Articles==
*[[Reverse Domain Name Hijacking]]
==References==
<references/>
[[Category: Bad Practice]]
|note = '''This information is brought to you by<br> [http://dnsseal.wiki/ DNS Seal], a best practices wiki for DNS.'''
| logo = DNS Seal.png
|link = http://dnsseal.wiki/
}}
'''Domain Name Hijacking''' or Domain Hijacking refers to the security breach that occurs when an outside agent, such as a hacker, gains control over a domain registered to another individual or organization.<ref name="report">[http://archive.icann.org/en/announcements/hijacking-report-12jul05.pdf Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions] (PDF), ICANN's SSAC</ref><ref name="go">[http://www.gohacking.com/how-domain-name-is-hijacked-how-to-protect/ How a Domain Name is Hijacked and How to Protect it] by Srikanth Ramesh, GoHacking.com</ref> Hijacking can be accomplished via various practices and often results in domain name registrants losing control of their domains as traffic is redirected to a different site, the content of the original site is changed, or the outside agent switches the control of the name through the registrar. <ref name="go"/> This practice has reportedly tripled since 2005 and is related to [[Reverse Domain Name Hijacking]]<ref name="cio">[http://www.cio.com/article/699206/4_Ways_to_Prevent_Domain_Name_Hijacking_?page=1&taxonomyId=3089 4 Ways to Prevent Domain Name Hijacking] by Meridith Levinson (February 1, 2012), CIO</ref>
==Public Perception==
Domain name hijacking is viewed negatively by most people and can be referred to as domain theft.<ref name="go"/>
==Outcome==
The broader outcome of this behavior is that users' domain names are at risk from predatory parties. Individuals can lose control of their domain names and larger organizations can face major losses, monetarily and in consumer confidence.
==Historical Use==
Domain name hijacking has been used for a number of purposes, such as "malice and monetary gain."<ref name="report"/> If the hijacked site deals with Internet commerce or retail, for example, its users may be redirected to a [[phishing]] webpage designed to steal their financial information.<ref name="cio"/> A domain name is vulnerable to hijacking through a number of different avenues:
*DNS Servers: if the DNS is hijacked or poisoned, people typing in a domain name may be redirected to another page without their knowledge.<ref name="cio"/> This method does not require any registrant account information to be compromised or readily available. See [[Pharming|DNS Hijacking]] for more information.
*Registrar Security: if a registrar's security is compromised and a domain name is not locked, it could be transferred to a different user and registrar before the owner is notified.<ref>[http://www.theregister.co.uk/2005/07/12/icann_domain_hijacking/ ICANN warns world of domain hijacking] by Kieren McCarthy (July 12, 2005), The Register</ref>
*Email Security: a third party can use WHOIS to find information about a registrant, such as a personal email account, and once the email account is compromised, use it to request a new password from the registrar.<ref name="go"/><ref name="cio"/> If the third party gains access to the registrant's account with its registrar, it can change primary ownership and notification information.
*Phishing: an outside agent can pose as a representative of the registrar and ask for log-in information directly.<ref>[http://www.ehow.com/how_8743588_recover-hijacked-domain.html How to Recover a Hijacked Domain] by James Johnson, eHow.com</ref>
==ICANN Policy==
*[[Transfer of Registrations between Registrars Policy]]: This policy requires that registrars send registrants an authorization/confirmation notice when domain names are going to be transferred and that registrants reply in a secure way.<ref>[http://www.icann.org/en/resources/registrars/transfers/policy-15mar09-en.htm Policy on Transfer of Registrations between Registrars | In effect until 31 May 2012], Internet Corporation for Assigned Names and Numbers (ICANN)</ref>
*[[Registrar Transfer Dispute Resolution Policy]]: This policy outlines how registrars deal with transfer disputes, including unauthorized transfers.<ref>[http://www.icann.org/en/help/dndr/tdrp Registrar Transfer Dispute Resolution Policy], Internet Corporation for Assigned Names and Numbers (ICANN)</ref>
**Note: It can be challenging to prove to registrars that a domain name has been hijacked as "Registrars are often skeptical of claims of domain hijacking."<ref name="help">[http://www.circleid.com/posts/help_domain_name_hijacked/ Help! My Domain Name Has Been Hijacked!] by Brett Lewis (January 12, 2007), CircleID</ref>
==Legislation==
There is no U.S. legislation that directly addresses domain name hijacking. However, as it potentially can involve theft, fraud, identity theft, and phishing, there are avenues for legal redress. It is worth noting that proving domain name ownership after being hijacked can be difficult.<ref name="help"></ref>
==Additional Resources and Tips==
*Read ICANN's Report on [http://archive.icann.org/en/announcements/hijacking-report-12jul05.pdf Domain Name Hijacking] for a brief overview of domain name hijacking and a thorough account of notable domain hijacking incidents
*View [http://www.ehow.com/how_8743588_recover-hijacked-domain.html How to Recover a Hijacked Domain]
*View ICANN's [http://www.icann.org/en/resources/registrars/transfers/foa-conf-12jul04-en.htm Standardized Authorization Form] required to transfer domain names from one registrar to another
*For tips on how to prevent domain name hijacking, read [http://www.circleid.com/posts/help_domain_name_hijacked/ Help! My Domain Name Has Been Hijacked!]
==Related Articles==
*[[Reverse Domain Name Hijacking]]
==References==
<references/>
[[Category: Bad Practice]]