Your domain is hijacked at the registrar
The prompt — read this to the room
At 07:10 customers of a 700-person online bank start reporting that the login page looks slightly wrong and asks for their one-time passcode twice. Your engineers find the domain’s name servers were changed overnight through the registrar’s web portal, using a staff account protected only by a password and SMS codes. DNS now points to attacker-controlled servers, and a certificate for your login hostname was issued to someone else at 03:40. Some resolvers still have the old records cached. The registrar’s support line opens at 09:00. How do you take your domain back, and what do you tell customers?
Who to involve
Most important first.
- IT operations
- Incident response lead
- CISO / Head of security
- Cloud engineer
- Vendor / procurement manager
- Communications / PR
- Legal counsel
What it tests
- Regain control of the domain through every channel available before the registrar opens.
- Limit customer harm from credential and passcode phishing while DNS is wrong.
- Get the fraudulent certificate revoked and find any others issued.
- Harden registrar, DNS and certificate controls so this cannot be repeated the same way.
Outline of activities
- 1Customer reports and the name-server change
- 2Reaching the registrar: escalation paths outside business hours
- 3Protecting customers: fraud controls, sessions and warnings
- 4Certificates: transparency logs and revocation
- 5Recovery, DNS cache tail and notification
- 6Registry lock, MFA and domain governance
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…