Microsoft prevents Domain of Danger from falling into miscreants’ paws by forking out cash for corp.com

Victims of early versions of Microsoft’s Active Directory can breathe a sigh of relief: the software giant has snapped up the infamous corp.com domain.

As noted by security researcher Brian Krebs, the big-hearted software giant stepped in after a private citizen put the domain up for sale.

The sale potentially put hundreds of thousands of Windows PCs at risk due to some iffy Active Directory settings around the time of Windows 2000 Server and equally iffy practices at companies setting up Microsoft’s then latest and greatest.

The issue arises from administrators accepting the example of “corp” during the setup of Active Directory in early versions of Windows. As an internal domain name, using something not owned by the company was pretty bad practice, but not immediately disastrous.

However, once employees took their gear into the big, wide world, having “corp” as an Active Directory path could send confidential data (including login attempts) to places it shouldn’t go, such as “corp.com”.

The previous owner of the domain, Mike O’Connor, told Krebs on Monday that Microsoft had agreed to purchase it for an undisclosed amount. Twenty-six years of watching thousands upon thousands of Windows computers trying to flash their undergarments at corp.com was enough for any person, and a hoped-for $1.7m – the asking price – would have done no harm either.

Microsoft has long discouraged customers from using domain names that they do not own but, as anyone tasked with maintaining an ancient Active Directory setup will attest, unpicking the mess created decades ago is not for the faint of heart.

Many admins will have looked at the challenges involved in taking down an entire Active Directory to deal with the issue, felt a bit sick, and decided that the risk of leaving the thing alone was bearable.

The move by Microsoft to ensure that corp.com does not fall into the hands of miscreants is therefore a good one, and buys today’s administrators a little more time to deal with the impact of a long-departed predecessor’s idle mouse-click all those years ago. ®

Sponsored: Webcast: Build the next generation of your business in the public cloud

READ MORE HERE