Hacking TLD EPP registry servers (2023)
10 months ago
- #EPP-vulnerabilities
- #domain-security
- #cybersecurity
- Researchers investigated the security of ccTLD/TLD registries and found vulnerabilities allowing control over DNS zones of several ccTLDs.
- EPP (Extensible Provision Protocol) servers are critical for domain management, facilitating communication between registries and registrars.
- A critical vulnerability in the CoCCA Registry Software allowed XXE (XML External Entity) attacks, leading to unauthorized file access and potential control over domain zones.
- The vulnerabilities were chained to access sensitive files, including SSH keys and database backups, compromising entire ccTLD zones.
- Google's Nomulus registry software was found to be secure against XXE attacks due to defensive programming.
- The research highlights the brittleness of internet infrastructure and the importance of securing registry software.