Critical WHOIS Vulnerability Exposed: Security Researcher Manipulates Certificate Authority Emails 🕵️‍♂️

News & Articles
1

Summary:

  1. Discovery of Vulnerability
    Security researcher Benjamin Harris revealed a critical flaw in the WHOIS system by registering an expired domain used by .mobi’s authoritative WHOIS server, gaining unauthorized access to sensitive data.

  2. Rogue Server Exploit
    The rogue WHOIS server received millions of queries and allowed Harris to control email addresses used by certificate authorities, such as GlobalSign, for domain verification processes.

  3. Ethical Considerations
    Harris halted further testing to avoid unethical consequences, highlighting systemic weaknesses in WHOIS client configurations and broader internet infrastructure management.

Read more at: Ars Technica