hannoDec 10
German ministry renames itself, domain expires, is bought by SEO-spammer, expires again, is bought by domain grabber, then later bought by itsec company who now learns that apparently plenty of internal systems of the ministry still try to connect to the domain...
I don't even know where to start how terrible that is and what it tells us about government IT security practices...
https://mint-secure.de/bundesdomain-im-blindflug-dns-leaks-und-ein-jahrzehnt-it-nachlaessigkeit/
@TimPhSchaefers good work!
Bundesdomain im Blindflug: DNS-Leaks und ein Jahrzehnt IT-Nachlässigkeit

Der Artikel zeigt, wie die vergessene Bundesdomain bafl.de weiterhin von Behörden-Systemen genutzt wird und DNS-Logs ausgewertet wurden.

Mint Secure
Show threadDmian 🇪🇺Dec 10
@hanno @TimPhSchaefers It’s very surprising to see that NIC .de doesn’t have a reserved second level domain for government sites (like the “.gov” or “.gob” you normally see, “.reg.de” maybe?). The German government buying private domains like a regular Joe is a really weak move. 😝
Show threadhallunke23 🇺🇦

DeNIC used to have a policy that 2-letter domains and any domain that matches a license plate code is unavailable.

Problem with that: VW sued against that policy because they wanted to register vw.de and won, so DeNIC had to abandon the policy. Now all the domain names that match license plate codes (which were supposed to be used by the district administrations) are in the hands of random people.

@dmian @hanno @TimPhSchaefers

Dec 10 at 9:31pmWeb
Show threadDmian 🇪🇺Dec 11
@hallunke23 @hanno @TimPhSchaefers Oh! Wow… That’s a really shocking bit of information. Thanks!