Sunday, July 30, 2006

A brief look over the crazy domain names business

Seems like this "virtual real-state" business is getting some publicity this month, after some news and interesting overviews appeared around on blogs and news sites. One of them is written by Dennis Forbes, with title "Interesting Facts About Domain Names". He checked thousands of domain names, with different number and word combinations, and surpisingly finding that most if not all, have been taken already. Do they have developed content? Seems like they don't. People starting a web-based business can have a tough time for finding a really good brand they can market and use for word-of-mouth advertisement, as they need to look for more complicated names, hyphen-based ones, using not so nice TLDs (ex. no .com, no .net, no .org).

Dennis did a certainly nice job for creating charts to show the statistics, one of them on the different possible length letter sequences:

Registered letter sequences domain names

Most companies go for a domain name broker or speculator to do the job for them, find a potentially brandable name and then starting the negotiations with the owner and finally doing the proper transaction via a escrow agent. The point is, How much do these brokers get out of each operation? The usual commission is around 10-5% of the final value.

How much does the owner get? Well, here we go with the interesting stuff.

Magazines and blogs that track and report domain name sales exist, one of the most known is DNJournal. Normally these sales are done via brokers or specific sites like Sedo which is recommended by most people working on the business. Let's see some of the sales:

Nasty.com for US $200,000 at Sedo

Tonight.de for US $14,464 at Sedo

Mapper.com for US $13,500 at Sedo

MadisonAvenue.com for US $23,500 on private sale

Everyone wants a six figure income, but you may think it's difficult as hell to get a brand-able domain name, and then sell it somewhere else. Well, you just need to be creative, expect to spend an initial budget of a couple of bucks and have patience. You're pretty much done. Just a couple of bucks? Nowadays, you can register a domain name for really low prices, for example at GoDaddy.com with offers of US $1 for each domain name, and discounts for bulk registering which is the most used facility by the annoying domain name business guys.


The next step would be opening an account on Sedo and starting promoting them, listing for sale, or just manage your way to find potential buyers and contact them. An usual recommendation is to stay out of the bad guys, or brokers and individuals which look to be alone but actually work for a company that "snipes" domain names.


There are tools out there that create permutations of words, take keywords and word lists and work upon such data for automatically checking WHOIS information and availability, then reporting each available domain name ready for speculation ;).


Although, as the Stylegala article says, it's the brand that matters, not just the keyword. Find something easy to pronounce, easy to write and remember, and most important: something that plays well with marketing. Could people spread the word on your site easily? "Hey mate, google for this stuff!". So, that's it.


Keyword-based domain names may help for SEO, but in the end people won't buy MyBrand cars. They'll buy just cars... dot com.


For a well brandable domain name, an individual could get more than US $1,000 always, but it all depends on the buyer and the patience of the seller. Like in real-state business, time matters. The benefit is evident, buy for one or few bucks, sell for thousands.




  1. Interesting Facts About Domain Names by Dennis Forbes.

  2. GoDaddy.com Domains Only $1.99

  3. Domain Name Analysis - More Fascinating But Entirely Useless Charts by Dennis Forbes

  4. 93% Of Domain Reigistrations For Scam Sites? at Techdirt.com

  5. Best Brands, Innovative Products at Slashdot

Friday, July 14, 2006

The other side of VirtualProtect() and friends: DEP evasion

As some people may think that the regression tests which involve VirtualProtect() usage for evading DEP, are wrongly implemented and present a legitimate feature as a potential risk, the images below show "hot spots" in the disassemble of Microsoft Windows Media Player and Skype. The first, as most multimedia applications in either GNU/Linux or Microsoft Windows, needs to generate code on run-time and this requires access to executable memory. Skype was known to break with Data Execution Prevention (DEP) enabled, until it was fixed...

Image below shows Skype allocating memory with PAGE_EXECUTE_RADWRITE access:

PAGE_EXECUTE_READWRITE 0x40

Enables execute, read, and write access to the committed region of pages.

Allocating memory with such a nice permission is for sure an easy way to get around DEP-related compatibility issues. Basically, DEP will be useless. If the memory area allocated, receives some-how user input (or at least is partially controlled by another process), code could be written and then executed without any barrier, including DEP protection.

19.01.2006 version 2.0.0.73

  • bugfix: crashes when DEP is supported in hardware

Now let's look over Windows Media Player....

It doesn't matter if we allocate memory with RWX (Read-Write-Execute) access or we just allocate it with write access and then change it to be executable. In any case, if memory becomes executable after writing from user-input or similar unsafe sources, DEP will be unable to protect against it, as there's no enforcement in place for memory access permissions. You just have to rely on the vendor, and trust that they didn't go the easy way and didn't fix their code, but just applied a workaround.

For further information:

  1. MSDN Memory Management functions: VirtualProtect()
  2. MSDN Memory Management functions: VirtualAlloc()
  3. MSDN Memory Protection Constants
  4. Blog on Cyberterror: A DEP evasion technique
  5. ZDnet blogs: Skype 2.0 looked like a virus
  6. Skype change-log
  7. Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform. By David Litchfield, NGSSoftware Insight Security Research (NISR).

Tuesday, July 11, 2006

Browser fun everyday

The people from the Metasploit project came up with a certainly nice idea: a blog-style publication for releasing web browser bugs and security flaws on a daily basis for one month. A rush of issues have been published, affecting a wide range of browsers, from Microsoft Internet Explorer to Safari. Just for the shake of mayhem and destruction, some issues will get published over here as well, discovered using either their tools (DOM-Hanoi, etc) or the under-going project for developing an easy to use QA and vulnerability assessment framework, QANUM (first show-case is out...).Today's one is a simple and not-really-useful NULL pointer dereference in the Macromedia Flash ActiveX component function LoadMovie():

a = new ActiveXObject('ShockwaveFlash.ShockwaveFlash');

try { a.LoadMovie(-1, "bogus.swf") } catch(e) { }

The bug is triggered by passing a non-zero value to the first parameter (which represents the layer for the loaded movie). Nothing really interesting, right? It seems already fixed in Flash 9 (finally after remaining in 8 for quite a bit of time), and it seems there was previous knowledge of the bug, two years ago. Nice timing.