<story><title>Microsoft buys corp.com so bad guys can’t</title><url>https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/</url></story><parent_chain><item><author>LeonM</author><text>For those not familiar with the corp.com situation:&lt;p&gt;Corp.com was (is?) the default example domain in many applications from Microsoft. As a result many badly configured networks are attempting to connect to this domain, often sharing credentials in the process.&lt;p&gt;He who owns corp.com will have access to tens of thousands of corporate networks. So the only move that MS had was to buy the domain, regardless of the price.&lt;p&gt;I guess mr O’Connor (who sold the domain) made a nice retirement today.</text></item></parent_chain><comment><author>andrewaylett</author><text>It&amp;#x27;s more that `CORP` was the default short name for the AD domain, and also Windows ticks the &amp;quot;try superdomains&amp;quot; box in search domains by default.&lt;p&gt;So if you have your fully-qualified AD domain set to `ad.example.com`, that&amp;#x27;s the default search domain too, and a DNS lookup for `corp` will first check `corp.ad.example.com` then `corp.example.com` then `corp.com`.&lt;p&gt;Now, if you&amp;#x27;re using the AD server as your DNS server then it shouldn&amp;#x27;t get that far -- `corp.ad.example.com` should resolve.  But if for whatever reason a device connected to AD doesn&amp;#x27;t use the AD server as its DNS server, for example if it&amp;#x27;s a laptop and not connected to the corporate network, then you&amp;#x27;ll be offered a _different_ search domain like `myisp.com`.  Which probably _won&amp;#x27;t_ resolve `corp.myisp.com`.  So the built-in resolver will after all walk its way up the search domain and check `corp.com` QED.</text></comment>
<story><title>Microsoft buys corp.com so bad guys can’t</title><url>https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/</url></story><parent_chain><item><author>LeonM</author><text>For those not familiar with the corp.com situation:&lt;p&gt;Corp.com was (is?) the default example domain in many applications from Microsoft. As a result many badly configured networks are attempting to connect to this domain, often sharing credentials in the process.&lt;p&gt;He who owns corp.com will have access to tens of thousands of corporate networks. So the only move that MS had was to buy the domain, regardless of the price.&lt;p&gt;I guess mr O’Connor (who sold the domain) made a nice retirement today.</text></item></parent_chain><comment><author>swyx</author><text>always wish i could be a fly on the wall for these kinds of negotiations.&lt;p&gt;if O&amp;#x27;Connor demanded something ridiculous like 10 billion dollars... how do you talk him down when the situation is this onesided?</text></comment>