js

console.log(parseInt(0.0000005))

5

- The researchers accidentally gained control of the .MOBI domain registry by purchasing the expired domain dotmobiregistry.net for $20.
- By controlling the legacy WHOIS server at dotmobiregistry.net, they were able to intercept and respond to WHOIS queries for .MOBI domains, including from major Certificate Authorities.
- The researchers discovered a critical vulnerability in the phpWhois library that allows remote code execution by injecting malicious data into WHOIS responses.
- They also found a command injection vulnerability in the fail2ban security tool that could be exploited via malformed WHOIS responses.
- The researchers were able to use their control of the WHOIS server to provide rogue email addresses to Certificate Authorities, allowing them to obtain valid TLS/SSL certificates for .MOBI domains they did not own.
- This undermined the entire Certificate Authority validation process for the .MOBI top-level domain, putting secure communications at risk.
- The researchers found that their WHOIS server was receiving millions of queries from a wide range of internet infrastructure, including government, spam filtering, and antivirus systems.
- The researchers did not actually issue any rogue certificates, but demonstrated the ability to do so, highlighting a critical flaw in the TLS/SSL certificate issuance process.
- The researchers notified the NCSC and ShadowServer Foundation, who worked to mitigate the issue by sinkholing the dotmobiregistry.net domain.
- The researchers conclude that this incident exposes fundamental flaws in how internet infrastructure and security processes like WHOIS and Certificate Authorities operate, which could be exploited by well-resourced attackers.