Domain theft spurs concern

[261275]

Ahmedabad, November 18: THE CID (Crime) that busted the cyber-crime racket on Friday has a piece of advice for those running online businesses. The online traders should be extremely careful in revealing the username and password of a domain to their employees. The CID’s advice is based on fears that the employees, when they leave the company, might misue them to their advantage.

In the case that came to light on Friday, accused Darshin Shah and his father Dipak Shah had used the password they knew to change the ownership of five online companies owned by complainant Sandeep Agrawal. The father-son duo had then transferred the ownership of the five companies to Paris-based William Stanley, thereby causing huge business loss to Agrawal.

CID probe says Darshin had access to Agrawal’s server and the passwords of his five online companies — the five websites— as he was a freelancer providing technical support for maintainance of the websites. He misused these passwords when he no longer worked for Agrawal.

According to experts, such incidents — where an employee cheats his employeer by misusing the password and then selling the domain to some other person — do happen frequently. Those who suffer the loss, however, hardly lodge police complaints— they fear their reputation in the market will be affected by this.

In Agrawal’s case, he approached the police only after the accused kept making extortion demands. The online firm he owned are ahmedabad.com, talash.com, talashinfosoft.com, evyapar.com, and allindiagift.com.

According to CID, Darshin had changed the ownership of these five websites to William Stanley four months back and then the accused demanded extortion money from Agrawal to give him back the control of the five domains. When the ownership changed, all the business orders coming on the five websites were diverted to Stanley’s e-mail address, which resulted into a huge loss of business for Agrawal.

‘‘By changing the ownership of the domain names, the three accused had diverted all the business queries to their e-mail addresses. In other words, they got a sizeable online traffic for free in their favour,’’ said a CID official involved in the investigation.

Jignesh Purani of CID says they have written to two domain registrars — one in Mumbai and the other in Paris— about the fraud. While the Mumbai agency had registered the five domains of Agrawal, the Paris agency might have had a role to play if it had been approached by Stanley.

‘‘According to World Wide Web (WWW) norms, the ownership of a domain name cannot be changed without prior knowledge and notice of the holder of the domain name,’’ said Purani.

DIG (CID) Anil Pratham says a number of aspects of the cyber crime are under investigation.

While Darshin and Dipak have been arrested under the provisions of the IPC and Information Technology Act, efforts are on to extradite Stanley from Paris. According to CID, Stanley is a known computer hacker in France and he had been once punished for a similar offence there.

Agrawal is not ready to give details of the money asked for by the three accused.

His lawyer, Rajesh Acharya, said the case was subjudice and so it could not be disclosed.

Source: http://cities.expressindia.com/fulls...?newsid=210057

[Rubber Duck]

Excellent! Growing awareness of domain value in India.

[thefabfive]

Nice reminder to change your passwords often.

[Drewbert]

Exactly! Especially when someone who has knowledge of them leaves your employ!

Also highlights the usefulness of a tiered management access system (such as openSRS) where you can allow someone password access to things like NS management of a domain without also allowing them access to the parts of the system where they can change admin address and email data.

[Rubber Duck]

At the domain level. we have a One Tier System!

[IDNHelios]

Originally Posted by Rubber Duck

At the domain level. we have a One Tier System!

nah not quite - depends on the registrar.

Look at Godaddy's service.

[Rubber Duck]

What I was suggesting is that whoever gets involved in developing domains for us now or in the future is not going to get the keys to the domain vaults.

As for Godaddy? Been there! Done that!

[IDNHelios]

Originally Posted by Rubber Duck

What I was suggesting is that whoever gets involved in developing domains for us now or in the future is not going to get the keys to the domain vaults.

As for Godaddy? Been there! Done that!

The web developer never needs access to the nameservers......
You can just have the nameservers set to where you want them to get the job done.