[registrars] SPOOFING mails sent from Verisign for transfer

["Bhavin Turakhia" <bhavin.t@directi.com>]

Hi,

I believe most of the high-volume registrars should be autoparsing emails
sent by the Registry notifying the Registrar about a transfer status.
Manually processing these would be very difficult and error prone.

However the auto-parsing method lends no security in the entire process. One
could actually spoof these emails to a Registrar to make them believe that a
wrong domain name is being transferred, or already transferred or cancelled
transfer - thus breaking their systems. For eg i have listed below the email
addresses where some registrars get these emails -

Nothing stops me from sending an EXACT Verisign email to any of these
addresses and make it appear completely genuine to these Registrars. And I
would hate to think what could happen if any of these addresses were somehow
made public (a pretty easy thing to do). Anyone in the entire world cold
then spoof FALSE emails notifying registrars about transfers of domains that
have not been transferred or sending in trabsfer requests etc - creating
havoc with a Registrars' system

The only way this maybe prevented is by using either PGP mail, or sending
the data in an encrypted attachment rather than as direct email.

david@registrars.com
gandi-routine@gandi.net
hostmaster@stargateinc.com
nsi-notify@joker.com
nsiinfo@bulkregister.com
nsinotices@inww.com
nsiregistry@enom.com
nsiroutine@domaininfo.com
reg_notify@omnis.com
registrar@domainpeople.com
registrar@dotearth.com
registrar@easyspace.com
registrar@namesecure.com
registrar@netsol.com
registrar_routine@godaddy.com
secretariat-nsi@corenic.org
system@planetdomain.com
transfer@dotster.com
transfers@aitdomains.com
transfers@nameit.net
transfers@opensrs.org

Best Regards
Bhavin Turakhia
CEO
Directi
----------------------------
Tel: 91-22-6370256 (4 lines)
Fax: 91-22-6370255
http://www.directi.com
----------------------------