The ability to send any data in response to queries to the old WHOIS service of the .MOBI domain zone was used to develop several types of attacks on query senders. The first attack variant was based on the assumption that if someone continues to send queries to a long-replaced service, they are likely doing so using outdated tools that contain vulnerabilities. <\/p>\n
For example, in phpWHOIS, a vulnerability labeled CVE-2015-5243 was discovered in 2015, allowing an attacker to execute code by parsing specially crafted data returned by the WHOIS server. Another instance is the vulnerability CVE-2021-32749 found in the Fail2Ban package in 2021, which permits the execution of external code when incorrect data is returned by the WHOIS service used to generate block notifications (Fail2Ban would identify the host administrator's email via WHOIS and include it in the mail command without proper escaping of special characters). <\/p>\n
The second attack is based on the fact that some certificate authorities provide the ability to verify domain ownership via email listed in the domain registrar's database accessible through the WHOIS protocol. It turned out that several certificate authorities supporting this verification method continue to use the old WHOIS server for the .MOBI domain zone. <\/p>\n
Thus, by gaining control over the whois.dotmobiregistry.net name, attackers can return their information, complete the verification, and obtain TLS certificate<\/a> for any domain in the .MOBI zone. For instance, during the experiment, the researchers requested a GlobalSign TLS certificate for the domain microsoft.mobi, and the email returned by the fake WHOIS service, 'whois@watchTowr.com', was shown in the interface as available for sending the domain ownership confirmation code. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b «.MOBI». \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u043e \u0442\u043e, \u0447\u0442\u043e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u043c\u0435\u043d\u044f\u043b \u0430\u0434\u0440\u0435\u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0432 \u0435\u0433\u043e \u0441 \u0434\u043e\u043c\u0435\u043d\u0430 whois.dotmobiregistry.net \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0445\u043e\u0441\u0442 whois.nic.mobi. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043c\u0435\u043d dotmobiregistry.net \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2023 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d \u0438 \u0441\u0442\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Attempt to obtain TLS certificates for other people's mobi domains using an expired domain with WHOIS service | ProHoster","description":"Researchers from watchTowr Labs published the results of an experiment capturing the outdated WHOIS service of the .MOBI domain zone registrar.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f \u0447\u0443\u0436\u0438\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 mobi, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b ".MOBI".","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-12T01:43:01+00:00","article:modified_time":"2024-09-12T01:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:28:23","updated":"2026-02-09 17:33:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/119766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=119766"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/119766\/revisions"}],"predecessor-version":[{"id":159214,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/119766\/revisions\/159214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/119767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=119766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=119766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=119766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Attempt](\"\/wp-content\/uploads\/2024\/09\/2f642bc104438ee5f0885721eea42ac5.png\")
<\/center>
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"