Forest Global Training Partners

Cyber Risks · Krebs on Security

U.S. Govt. Makes it Harder to Get .Gov Domains

Summary: The U.S. General Services Administration said that effective March 10, 2020, all new .gov domain applications must include notarized signatures on authorization letters, a change announced March 5, less than four months after KrebsOnSecurity reported that an anonymous source obtained the .gov domain exeterri[.]gov by impersonating an official at a small Rhode Island town using forged letterhead. The GSA said the step is meant to prevent mail and wire fraud through signature forgery, while domain expert John Levine called it a classic case of 'we must do something,' and CISA has backed the DOTGOV bill to validate existing .gov holders.

Bottom line: The source who faked a .gov application needed only Yellow Pages records and a forged letterhead, and the GSA granted the phony domain roughly 10 days before pulling it back only after Krebs asked for comment - so a notarization requirement does nothing about the fraudulent .gov domains already issued.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related