Reference: Insider Domain Trading

Test A-R53-11 specifically looks for Domains that do not have a transfer lock enabled. A transfer lock is nothing more than an additional step ahead of transferring a domain to ensure a “belt & braces” type confirmation that a domain should definitely be transfered. All a transfer lock requires is that the transfer lock is disabled by an API call or a confirmation in the AWS Web Console ahead of initiating a transfer. However, this simple mechanism provides a few additional features to help protect domains from being stolen, even to insiders.

Concept ¶

In a real life criminal incident, an unauthorised sale of the domain name sofa.com by an employee of Dinesen’s Leather Only, Stephen M. Galstad. The sale amounted to $200,000 and was conducted without the employer’s permission, culminating in legal charges against Galstad. The transaction was executed without proper authorization, with a wire transfer of the sale payment to Galstad’s personal account. Galstad had legitimate access to the domain and was an administrator, however, obviously did not have permission to sell the highly prized domain for personal benefit.

Impact ¶

The unauthorised sale has several impacts to a number of parties:

• Intermediary Financial loss for Dinesen’s Leather Only, as the domain was sold without their consent.
• Legal implications for Galstad, including civil and criminal repercussions.
• Possible litigation between the legitimate buyers of sofa.com and Dinesen’s Leather Only, depending on the outcome of ownership claims.
• A considerable amount of paperwork and other impacts to all parties in determining ownership and reverting the illegitimate activity.
• Technical impacts from configuration changes to the domain from the new owners and during transfer.

Expansion ¶

Domains are a key part of an organisation’s identity, intellectual property and service functionality. As domains can be transferred with a few simple emails containing an authorisation code it’s trivial for a motivated insider to complete transfer activity without attracting significant attention. Additionally, as in this case, private market sales can also request that the transfer can be completed without an obvious transaction as the purchasing party is effectively purchasing an authentication code with which they can initiate transfer of the domain.

With communications being spread across potentially private emails and transactions it’s possible for an insider to sell domains to third parties privately, obtain the proceeds and escape before the deception can be discovered.

Conclusion ¶

The sofa.com incident serves a great reminder for how critical domains are and how the additional level of gating that transfer locks provide. Domain registrars in the modern day have built further on transfer lock functionality, allowing users to restrict the ability to remove a transfer lock to those with special permissions as well as increased alerting and other visibility to further protect against insider threats.

Transfer locks are easy and straightforward with additional monitoring and configuration available to lock your domains down from even focused attackers

References ¶