Forest Global Training Partners

Cyber Risks · Krebs on Security

It’s Way Too Easy to Get a .gov Domain Name

Summary: A researcher obtained the .gov domain exeterri.gov on Nov. 14 by emailing a filled-out authorization form on forged town letterhead, using a fake Google Voice number and fake Gmail address while impersonating the mayor of Exeter, Rhode Island. The GSA, which manages .gov registration, phoned the real town clerk on Nov. 24 - roughly 10 days after granting the phony request and four days after KrebsOnSecurity asked the agency about it - and CISA is seeking authority from Congress to take over governance of the .gov TLD from GSA.

What you should know: The source said the only real detail in his application was the mayor's name, and domains including houston.gov, losangeles.gov, newyorkcity.gov, philadelphia.gov, sanjose.gov and miami.gov were still available at the time of writing - meaning a state-sponsored actor could register a major city's .gov days before an election and send residents emails claiming bombs had gone off at polling stations.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related