For Sale any domain can be transferred!! Even LOCKED domains! Easy to exploit

[miloman]

Even registry locked domains can be transferred.
There's a huge bug that can be exploited at
the registry level that lets you transfer
any domain. Only restriction is that the domain
must be transferred to another registrar.

This will change the industry, hopefully they
fix it. I bet I could start taking over the
small fry domains without any suits.

Should I release the exploit?

 

[Domainaholic]

Nope as you know, or you would not have posted this

I am also certain someone else knows what you now know.

I saw Very bad security holes in 3 registrars - reported them to the registrar. 2 fixed it and thanked me - StarGate refused to listen, but I keep their secret safe.

 

[Bob]

I know all about Stargate's hole. I have had some high-powered names there. I transferred them IMMEDIATELY. Stay away from Stargate. Bad things afoot there.

-Bob

 

[Fearless]

I had someone accidentally hijack a name I bought from him for $12K at Stargate. Avoid Stargate unless your name is only worth $6.49.

 

[Domainaholic]

I really do not know of the hole you are talking about miloman - but I do know it is currently being used. I think dot orgs are the most vunerable, but can't confirm that.

Do not accept much thanks or gratitude, but report it to the registrars anyway.

 

[timechange.com]

From Tom at Stargate - [email protected]

It is impossible to transfer REGISTRAR-LOCK domains. It simply cannot happen. The request cannot be initiated by the gaining registrar, the registry auto-nacks the request before the transfer request is sent to the losing registrar for approval.

Since I am not a member of dnforums, if you wouldn't mind, please have this person who attempted to contact us send over the "exploit". I would be happy to review it. He or she can send it to [email protected]

Thanks,

Tom

 

[GiantDomains]

I am also aware of the security problems at stargate. I moved everything out long ago.

 

[Nexus]

I just had a domain transferred away recently. The way it was handled certainly disturbed me, but it was the only one from a recent auction purchase.

miloman, I hope you've alerted a number of the registrars (and the registry) and have gotten responses back.

~ Nexus

 

[mole]

Hey, does this security bug affect eNOM???