ICANN Warns of Domain Hijacking

Web sites risk having their Web addresses stolen because of flaws in the way domain names are registered, transferred and tracked, said ICANN officials.

During an international meeting of ICANN (Internet Corporation for Assigned Names and Numbers) in Luxembourg last week, officials delivered a report warning of the domain hijacking problem, which followed at least two high-profile incidents this year of domain name hijacking—one hitting ISP Panix and another affecting e-mail provider Hushmail.

Domain name hijacking occurs when someone fraudulently takes control of a domain name, often by masquerading as the legitimate administrative contact for a domain name. The e-mail addresses of administrative contacts, widely available in the WHOIS database of domain registrations, are used to verify domain name holders.

The report on domain name hijacking came from ICANNs Security and Stability Advisory Committee. “Our job really was to shine light on [the] problem and the basics of what needs to be done,” said Steve Crocker, chairman of the advisory committee. “Now we stand back out of the way because were not the ones to implement that.”

The committees conclusions left no doubt that the consequences of a domain hijacking can be stark.

“The registrant may lose an established identity and be exposed to extortion,” the report states. “Domain hijacking can disrupt or severely impact the business and operations of a registrant.”

Among the causes cited for hijackings was the relationship between official ICANN registrars and their resellers.

Committee member Ram Mohan said that right now, the burden lies with registrars to ensure that their resellers follow ICANN procedures.

“The fact is that there are 150 active [ICANN] registrars and some 20,000 to 25,000 resellers,” said Mohan, vice president and chief technology officer for Afilias Ltd., based in Dublin, Ireland, the registry for the .info domain. “These resellers are invisible to ICANN and registries.”

Matt Hicks is a senior writer for eWEEK.com.