Difference between revisions of "Allowing Domains or Accounts to Expire"
From OWASP
(Created page with '{{Template:Vulnerability}} Last revision (03/12/10): '''{{MAR}}/{{12}}/{{2010}}''' Vulnerabilities Table of Contents ==Description== Through negle…') |
|||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
| + | {{taggedDocument | ||
| + | | type=inactiveDraft | ||
| + | }} | ||
| + | |||
| + | |||
{{Template:Vulnerability}} | {{Template:Vulnerability}} | ||
Last revision (03/12/10): '''{{MAR}}/{{12}}/{{2010}}''' | Last revision (03/12/10): '''{{MAR}}/{{12}}/{{2010}}''' | ||
Latest revision as of 20:12, 31 August 2015
This page contains draft content that has never been finished. Please help OWASP update this content! See FixME.
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
Last revision (03/12/10): Template:MAR/Template:12/Template:2010
Vulnerabilities Table of Contents
Description
Through neglect an administrator may allow a domain name or e-mail account to expire. Domains have a significant grace period for expiration, and e-mail addresses using free services such as Yahoo may expire after several months of not logging in.
Risk Factors
- The biggest risk involved is if you have an e-mail server on a domain that is allowed to expire. The more users there are, the more personal information you are putting at risk when they use those e-mails as backup e-mails for accounts on websites. An attacker can simply purchase the domain and setup a mailserver. By analyzing the spam coming in, they can determine the actual usernames people used on the domain and possibly what services they used with those e-mails.
- Considering that, you should be careful only to use e-mails hosted on domains owned by companies that don't show any sign of going under in the future.
- There is very little recourse if a malicious entity has purchased your domain. They can sell it back to you for however much money they want to charge. Even if you have grounds for a lawsuit, it can take months at least.
- If you have applications(especially no-longer supported) sending data to a domain, if an attacker buys the domain they can gather personal information from your users.
- Domains most likely to expire are those belonging to projects or companies that no longer exist.
