- The researchers accidentally gained control of the .MOBI domain registry by purchasing the expired domain dotmobiregistry.net for $20.
- By controlling the legacy WHOIS server at dotmobiregistry.net, they were able to intercept and respond to WHOIS queries for .MOBI domains, including from major Certificate Authorities.
- The researchers discovered a critical vulnerability in the phpWhois library that allows remote code execution by injecting malicious data into WHOIS responses.
- They also found a command injection vulnerability in the fail2ban security tool that could be exploited via malformed WHOIS responses.
- The researchers were able to use their control of the WHOIS server to provide rogue email addresses to Certificate Authorities, allowing them to obtain valid TLS/SSL certificates for .MOBI domains they did not own.
- This undermined the entire Certificate Authority validation process for the .MOBI top-level domain, putting secure communications at risk.
- The researchers found that their WHOIS server was receiving millions of queries from a wide range of internet infrastructure, including government, spam filtering, and antivirus systems.
- The researchers did not actually issue any rogue certificates, but demonstrated the ability to do so, highlighting a critical flaw in the TLS/SSL certificate issuance process.
- The researchers notified the NCSC and ShadowServer Foundation, who worked to mitigate the issue by sinkholing the dotmobiregistry.net domain.
- The researchers conclude that this incident exposes fundamental flaws in how internet infrastructure and security processes like WHOIS and Certificate Authorities operate, which could be exploited by well-resourced attackers.

<!DOCTYPE xmlbomb [
<!ENTITY a "1234567890" >
<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;">
<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;">
]>
<bomb>&d;</bomb>

<!DOCTYPE bomb [
<!ENTITY a "xxxxxxx... a couple of ten thousand chars">
]>
<bomb>&a;&a;&a;... repeat</bomb>

<!DOCTYPE external [
<!ENTITY ee SYSTEM "http://www.python.org/some.xml">
]>
<root>&ee;</root>