Re:Microsoft buys corp.com so bad guys can’t
by fortran77 on Tuesday April 07, 2020 @12:31PM
(#22804690)
This is not an accurate explanation of the problem.
> Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled.
While it's true that access used "corp.com" as a sample domain, the problem is what Krebs calls "domain DNS devolution"
> Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”
Krebs has written two articles about this that explain the problem.
> Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled.
While it's true that access used "corp.com" as a sample domain, the problem is what Krebs calls "domain DNS devolution"
> Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”
Krebs has written two articles about this that explain the problem.