Eight-year-old DNS “Sitting Ducks” vulnerability exploited to hijack web domains with impunity

DNS hacks usually fall into obvious types, such as DNS poisoning (manipulating DNS records to redirect users), domain hijacking (adding malicious subdomains to a DNS record), or CNAME attacks (hijacking expired subdomains time).

Sitting Ducks are different, and have to do with weaknesses in how domains are managed, or not managed. In some cases, domains became “lame”.

This happens when the domain registrar sends the so-called authoritative DNS to a second provider. For example, a domain is officially registered with one provider, but the DNS resolution itself is handled by a second provider’s server.