The Internet Corporation for Assigned Names and Numbers (ICANN) shut down two new generic top-level domain (gTLD) portals on February 27 after learning of a vulnerability that could have been exploited to view users’ data.
The security issue affected the New gTLD Applicant and GDD (Global Domains Division) portals, which contain information on New gTLD Program applicants and registry operators. The portals, only accessible to applicants and operators, are used to carry out evaluation and contracting processes, ICANN noted.
A vulnerability in these portals could have allowed an authenticated user to view the data of other users. The flaw was reported by an authorized user, ICANN said.
ICANN addressed the bug and restored access to the portals on March 2. The organization says it’s still investigating the incident, but so far there is no evidence to suggest that the portals have been accessed by unauthorized parties, or that any data has been exposed.
In December, ICANN said the email credentials of several staff members had been compromised as a result of a spear phishing attack. At the time, the organization noted that the attackers didn’t gain access to the most critical systems, but they had managed to obtain administrative access to files in the Centralized Zone Data Service (CZDS).
Over the past months, hundreds of new gTLDs have been made available to the public. Unfortunately, some of them are mainly used for shady websites. A perfect example is .country, which according to Blue Coat, is the “king of shady domains.”
In January, Blue Coat advised its customers to consider blocking the entire .country TLD space because many of the websites appeared to be part of a scam network. Blue Coat has determined that only 10 of the top 40 .country websites analyzed in the last seven days are legitimate.
On Monday, Blue Coat alerted users to steer clear of .kim websites because 85% of the top 40 sites are “shady in some way.”
