domains Major domain name bug allowed hackers to register malicious domains

[Lox]

Thanks to a bug at some of the internet’s largest domain registrars, bad actors were able to register malicious domains until just late last month.

If I told you to click this on this URL, amɑzon.com, and login for a great limited time deal over at Amazon, would you notice it wasn’t really Amazon’s domain name?

Hover over it, give it a click. You’ll find that it actually directs you to xn—amzon-1jc.com. Why? Look closely and you’ll notice that the second “a” and the “o” aren’t actually the letters “a” and “o” from the Latin alphabet, which is what’s used in the English language.

It’s not supposed to be possible to register these domain names due to the malicious attacks they could be used for. Many web browsers change the characters in the URL from Unicode to Punycode, as seen in the earlier example, for that very reason.

The zero-day, or previously unknown, bug was discovered by Matt Hamilton, a security researcher at Soluble, in partnership with the security firm Bishop Fox.

read more > (Mashable) read more > (Soluble)

 

[Greg123]

Such kind of potential problems can only be solved at ICANN level.

According to my knowledge ICANN has serious policies for preventing any misuse or misunderstandings at TLD levels. A few years ago when we examined the process for proposing a new gTLD to ICANN, we understood & appreciated the measures that ICANN proposed to prevent any malicious or unintended domain registrations. (For example if you want to be a new registry proposing a new gTLD to ICANN; you cannot propose ".com" with an "o" from Cyrillic alphabet.)

So as the measures are taken at "domain extensions" level by ICANN, the same measures can be taken by them for the "domains" level too.