Microsoft keeps the bad guys away, purchases Corp domain name

Today, security expert Brian Krebs posted on this blog that Microsoft has apparently purchased the domain corp.com.  The domain went up for auction at a starting price of $1.7 million when it was listed by its Wisconsin native, Mike O’Connor, who has owned the domain for 26 years. Microsoft’s goal in purchasing the domain was to keep the domain out of the hands of nefarious actors and based on the previous owner’s statement it seems like Microsoft had good reason to take this action. Mike O’Conner indicated that “hundreds of thousands of Windows PCs are trying to share sensitive data with corp.com,”

The domain could have created potential security issues for the company’s Windows clients where admins used the generic domain name when setting up Active Directory, also known as namespace collision. For years, experts have suggested that whoever would gain access to corp.com would also potentially get access to sensitive data from hundreds of thousands of Windows systems around the world.

While we all laud Microsoft for its efforts around security including their purchase for TLS 1.2 that doesn’t mean the issue is resolved. Microsoft’s purchase helps safeguard companies that have built Active Directory infrastructures on top of “corp” or “corp.com,” however any company that has tied their internal Active Directory network to a domain they do not control is still opening itself to a similar potential security nightmare.