Eight-year-old “Sitting Ducks” DNS weakness exploited to hijack web domains with impunity

DNS hacks usually fall into obvious types, such as DNS poisoning (manipulating DNS records to redirect users), domain shadowing (adding malicious sub-domains to a DNS record), or CNAME attacks (hijacking lapsed sub-domains).

Sitting Ducks turned out to be different, and had to do with weaknesses in the way domains are administered, or not administered. In some cases, domains were becoming “lame”.

This happens when the entity registering a domain delegates what is called authoritative DNS to a second provider. For example, a domain is registered legally with one provider, but the DNS resolution itself is handled by a server belonging to a second provider.