Talos Finds DNS Misconfigurations in .kids and Other Domains That Could Enable Abuse

Summary

Talos found that .kids allowed registration of a controlled-interruption name used by SCCM clients, while several other domains return DNS records for nonexistent names, creating risks including misdirected email.

Key points

The .kids TLD returned some controlled-interruption records but lacked the expected 127.0.53.53 A record and allowed registration of the warning hostname.
After Talos registered that hostname, it received HTTP requests from Microsoft System Center Configuration Manager endpoints, creating a risk of masquerading as a trusted system.
Talos reported the .kids issue to its administrators, who subsequently removed the TXT, MX, and SRV records.
The .ws, .vg, and .ph domains returned IP addresses for expired or unregistered names instead of NXDOMAIN responses.
The .ws DNS behavior also directs email for unregistered names to a mail server; .vg accepts connections at its returned IP, though delivery attempts failed with a 550 error.
The article also found similar behavior at com.de and us.org; mail delivery for nonexistent names was rejected by the cited servers, while us.org's NULL MX handling may be mishandled by some mail systems.

Article Details

Attack Vectors: DNS name collisions can cause systems using internal .kids names to resolve the publicly registered your-dns-needs-immediate-attention.kids domain, allowing its registrant to masquerade as a trusted system and potentially relay internal mail or influence configuration management.
Some TLDs return IP addresses or mail servers for expired or unregistered names instead of NXDOMAIN, potentially directing mail or other traffic to unintended destinations.
Defensive Notes: Network administrators should monitor DNS logs for the controlled-interruption name and address described in the article: your-dns-needs-immediate-attention.<TLD> and 127.0.53.53.
TLD operators should prevent public registration of the controlled-interruption name and remove obsolete controlled-interruption DNS records; the article reports that .kids removed its TXT, MX, and SRV records after Talos contacted its administrators.

Vendors

MicrosoftTalos set up an internet server to log all activity related to this name, and immediately we received a barrage of HTTP requests from systems running Microsoft’s “System Center Configuration Manager.”

Products

Microsoft Configuration ManagerTalos set up an internet server to log all activity related to this name, and immediately we received a barrage of HTTP requests from systems running Microsoft’s “System Center Configuration Manager.”

Countries

British Virgin IslandsThe .vg country-level TLD belongs to the British Virgin Islands and, like the .ws ccTLD, when a name at .vg expires (or if it is a new name that was never registered), DNS servers will respond with an IP address.PhilippinesUnsuccessfully attempting to send mail to the implicit MX offered by .vg..ph ccTLD — The Philippines Western Samoa.ws ccTLD — Western Samoa