Security problem closes Domainz website temporarily

By MICHAEL FOREMAN

A security problem forced Domainz, the company that runs the internet domain name system in New Zealand, to temporarily close its website.

The loophole allowed anyone to view the event log of changes made to the 72,000 domain name records at www.domainz.co.nz by typing in any valid user identity.

The Domainz site is used by internet service providers and individuals to set up and record the ownership and other details of internet addresses ending in .nz.

Robert Gray, acting chairman of domains at Domainz' owner, the Internet Society of New Zealand, said the fault allowed domain name agents to see the changes made by other agents.

Domainz chief executive Patrick O'Brien said he became aware of the bug on Wednesday afternoon after reading a newsgroup message posted by Peter Mott of Auckland internet company 2Day.com.

The message gave details of how to access the event log and was signed off: "Happy reading, people."

Mr Mott, who has a long-running dispute with Mr O'Brien, said his decision to expose the security flaw publicly was deliberate but he had also warned Mr Gray first.

Mr O'Brien said the problem was fixed in 30 minutes by the website's developer, Advantage Group, but a second fault was discovered later that evening, which required taking the system offline.

The second problem allowed the entire event log to be downloaded.

Mr O'Brien said the website was now back online and fully secure.

Links


Domainz

2day.com