Well, but godaddy is not the source. As they mention (see
http://www.icann.org/registrars/wdrp.htm), this is an ICANN requirement
(or at least a logical interpretation of this requirement). It is true
though the ICANN suggest sending the information for review in the body
of the e-mail.
I would also argue that:
- People who register domains are more educated than others regarding
phishing.
- I rechecked the mail I received from them and their instructions did
not work for me, but it seems that the method they use which is to
provide you with a key in the e-mail, rather than asking for a login
might actually be a way to mitigate phishing.
~ Ofer
Ofer Shezaf
OWASP Israel Chair
http://www.owasp.org/local/israel.html
CTO, Breach Security
Phone (US): +1 (760) 268.1924 ext. 702
Phone (Israel): +972 (9) 956.0036 ext.212
Cell: +972 (54) 443.1119
ofers@breach.com
http://www.breach.com
-----Original Message-----
From: Andrew van der Stock [mailto:vanderaj@greebo.net]
Sent: Thursday, October 27, 2005 9:50 AM
To: webappsec@securityfocus.com
Subject: Smells like a phish, is a fish?
I have my domains registered with a popular registrar, and they've
sent the most phishy e-mail I've ever seen from a major provider:
---
Dear Andrew van der Stock,
It's that time of year again. ICANN (the Internet Corporation for
Assigned Names and Numbers) annually requires that all accredited
registrars (like Go Daddy(R)) ask their domain administrators/
registrants to review domain name contact data, and make any changes
necessary to ensure accuracy.
To review/update your contact data, simply:
+ Go to www.godaddy.com/?isc=ICANNKEY
+ Click on the "ICANN Domain Confirmation" icon at the top of
the page
+ You will be taken to a landing page and asked to enter your
Domain Information Key: <removed>
+ Enter your key and click "Go."
(more phish deleted)
---
I confirmed with the registrar that indeed they did send this phishy
e-mail. How do we get through to large organizations - who really
should know better - that they most of all shouldn't smell like a
phish market?
thanks,
Andrew
