<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jan 29, 2020, at 3:48 PM, Rubens Kuhl <<a href="mailto:rubensk@nic.br" class="">rubensk@nic.br</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="" style="caret-color: rgb(0, 0, 0); font-family: HelveticaNeue; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
I was under the impression that<span class="Apple-converted-space"> </span><a href="http://corp.com/" class="">corp.com</a> was now part of ORDINAL, but the fact that it's for sale for USD 1.7 Mi goes against that assumption</div>
<div class="" style="caret-color: rgb(0, 0, 0); font-family: HelveticaNeue; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
Perhaps Jeff (JAS) could clarify it. </div>
</div>
</blockquote>
</div>
<br class="">
<div class="">Jeff Schmidt sent the text below to clarify the situation with <a href="http://corp.com" class="">
corp.com</a>. Please also see the attached PowerPoint presentation.</div>
<div class=""><br class="">
</div>
<div class="">Matt</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">Begin forwarded message:</div>
<br class="Apple-interchange-newline">
<div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class="">Jeff
Schmidt <<a href="mailto:jschmidt@jasadvisors.com" class="">jschmidt@jasadvisors.com</a>><br class="">
</span></div>
<div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class=""><b class="">[Ext]
For posting to the NACP list</b><br class="">
</span></div>
<div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class="">February
4, 2020 at 12:29:18 PM EST<br class="">
</span></div>
<div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;" class="">David
Conrad <<a href="mailto:david.conrad@icann.org" class="">david.conrad@icann.org</a>>, Matt Larson <<a href="mailto:matt.larson@icann.org" class="">matt.larson@icann.org</a>><br class="">
</span></div>
<br class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: HelveticaNeue;">
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">Hia gents:<o:p class=""></o:p></span></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">I hear that there was an inquiry about <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> by the NCAP; please feel free to publish the below response _in its entirety_. It is good to have
this history a part of “the record.” You may post/share this as you see fit. Thanks!</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"><a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">Corp.com</a> has been owned by Mike O’Connor for just under forever. Mike recognizes that <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> is
unique and he has graciously made data available to a number of researchers – including JAS – over the years in the best interest of the Internet. The <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> data – and the understanding
of the underlying phenomena driving the traffic – contributed materially to the JAS collisions work/reports and to our discovery of MS15-011 thru 014 (CVE-2015-0008) as well as vulnerabilities JAS discovered and privately reported to PeopleSoft/Oracle, Symantec,
Trend Micro, and IBM. </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">Through Mike’s quiet generosity, the Internet is a safer place today.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">My interest, as a security professional, is that <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> remain in “responsible hands.” There remains significant danger if <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> becomes
controlled by an “irresponsible” party. I have tried for years to get “responsible parties” interested in acquiring <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> – including several firms on this list – however none have
expressed interest. Fortunately, the US Department of Homeland Security (DHS) stepped-up – the *<b class="">only</b>* party to do so I might add – and provided a small grant for JAS to lease <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> from
Mike, collect data, and make it available to qualified researchers. During the years <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> was delegated to JAS, we spent far more money hosting, collecting, and storing data than
we ever got from grants. No one except the US DHS expressed any willingness to help. My understanding is that ICANN wrote letters to Microsoft, Verisign, and other relevant parties informing them of these issues, but they did not engage. I tried to engage
Microsoft at a number of levels, but they were not interested.[1] JAS got poor and Mike sat on a valuable asset for years in the altruistic interest of global Internet SSR.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">A few months back, Mike and I concluded that we have done everything we can do; with Mike not getting any younger, he would sell the domain with a clear conscience. JAS has no further business relationship with Mike
or <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> and we are no longer technically hosting the domain.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">I have attached a technical presentation I gave to IMPACT researchers in 2018. It contains more technical information about the traffic observed at <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> and
some cool “DITL” statistics. </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">A few high level observations during the 8-month period 2019-01-24 - 2019-09-18:</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">* 384,001 unique client IPs sent queries to <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a>. These clients are almost all recursives ranging from gigantic public recursives (Google, OpenDNS)
to private recursives run by companies ranging from SMBs to large multi-nationals.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">* 37,046,965 unique qnames were sent to <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a>. A plurality of these qnames are related to Microsoft technologies, particularly Active Directory.
A subset of these are exploitable by techniques similar to MS15-011 thru 014 and trivially exploitable using well-known tools like Responder/SMB-Relay[2]. </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">* For additional perspective, in one month, the HTTP/S website JAS ran at <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a> received requests from 379,403 unique clients for WPAD configuration
files. Note these are IP addresses of specific end machines received over HTTP/S, not DNS recursive servers as above. Therefore, this is one of several long- lived target lists of almost certainly vulnerable Microsoft Windows machines. Another party made
a big deal about purely theoretical WPAD vulnerabilities in the new gTLD space a few years back; colliding WPAD queries are much more common and much more dangerous in .com than in any other namespace just given the size and gravitas of .com. Want an instant
foothold into about 30 of the world’s largest companies according to the Forbes Global 2000? Control <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a>. Anyone claiming namespace collisions in .com, country code, and other legacy
TLD space aren’t dangerous just doesn’t understand – or doesn’t want to understand.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">* JAS temporarily created MX records and accepted email destined to <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a>. After about an hour we received in excess of 12 million emails and
discontinued the experiment. While the vast majority of the emails were of an automated nature, we found some of the emails to be sensitive and thus destroyed the entire corpus without further analysis.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">* JAS temporarily accepted protocol level connections to SMB/CIFS and WebDAV over HTTP/S (!!) and found a large number of dangerous connections requesting <a href="file:////SYSVOL" class="" style="color: rgb(5, 99, 193);">\\SYSVOL</a>, <a href="file:////NETLOGON" class="" style="color: rgb(5, 99, 193);">\\NETLOGON</a>, <a href="file:////USER" class="" style="color: rgb(5, 99, 193);">\\USER</a>,
and other dangerous Microsoft mount points directly exploitable by the techniques described in MS15-011 thru 014. We discontinued the experiment after 15 minutes and destroyed the data. It was terrifying. A well-known offensive tester that consulted with
JAS on this experiment remarked that during the experiment it was “raining credentials” and that “he’d never seen anything like it.”</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">* Microsoft incorrectly claims these issues are resolved. Unless administrators overtly enable SMB Signing (via a new feature called “UNC Path Hardening” which they added as a response to our bugs), most modern, fully-patched
Windows machines remain vulnerable.[3]</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">Someone will eventually purchase <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a>. I sincerely hope the acquiring party is “responsible.” Once it’s lost, it’s gone forever.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">Jeff Schmidt</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">[1] Microsoft Windows product groups acted honorably upon our reporting of the vulnerabilities and responded appropriately; however, other parts of the company were not interested in discussing <a href="http://corp.com/" class="" style="color: rgb(5, 99, 193);">corp.com</a>.</span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">[2] <a href="https://github.com/lgandx/Responder" class="" style="color: rgb(5, 99, 193);">https://github.com/lgandx/Responder</a></span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;">[3] <a href="https://security.stackexchange.com/questions/134388/how-does-unc-path-hardening-and-smb-signing-work-under-the-hood" class="" style="color: rgb(5, 99, 193);">https://security.stackexchange.com/questions/134388/how-does-unc-path-hardening-and-smb-signing-work-under-the-hood</a></span><o:p class=""></o:p></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span></div>
<div class="" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span class="" style="font-size: 11pt;"> </span></div>
</div>
</div>
</blockquote>
</div>
</body>
</html>