Turkish hackers strike websites with DNS hack
Websites belonging to major companies were redirected to a defacement page via DNS record tampering
IDG News Service - A Turkish hacking group managed to tamper with Internet addressing records over the weekend, redirecting eight websites belonging to companies including UPS and Vodafone to a different web page controlled by the hackers.
According to Zone-H, a website that tracks defacements, 186 websites were redirected to a page controlled by "Turkguvenligi." A message on the redirect page read: "4 Sept. We Turkguvenligi declare this day as World Hackers Day - Have fun ;) h4ck y0u."
All of the websites were registered through NetNames, which is part of NBT group. NetNames provides DNS (Domain Name System) services for the websites, which is the system used to translates a domain name into an IP address that can be called into a web browser.
Turkguvenligi managed to hack NetName's DNS servers through a SQL injection attack, which involves putting commands into a web-based form to see if the back-end database responds. If those commands aren't scanned for malicious code, an attacker could gain access to the system.
In the case of NetNames, Turkguvenligi put a redelegation order into the company's system and changed the address of the master DNS servers that served data for the websites, according to a statement from NetNames. The attack occurred around 9 p.m. BST on Sunday.
"The rogue name server then served incorrect DNS data to redirect legitimate web traffic intended for customer web sites through to a hacker holding page branded Turkguvenligi," the statement read. "The illegal changes were reversed quickly to bring service back to the customers impacted and the accounts concerned have been disabled to block any further access to the systems."
The hack accomplished by Turkguvenligi is a powerful one. Although it appears the goal of the group was just to vandalize the sites for a while, the group could have set up lookalike sites for the real ones, tricking users into thinking they were on the legitimate site and possibly stealing logins and passwords.
Other websites affected were those belonging to The Telegraph newspaper, The Register technology news site, Acer and the National Geographic.
The Register wrote that its website was not breached and that service was restored about three hours after the attack.
"As far as we can tell there was no attempt to penetrate our systems," wrote Drew Cullen . "But we shut down access/services - in other words, anything that requires a password - as a precaution."
DNSSEC, a security measure now being deployed by many registrars to guard against DNS tampering may not have prevented this kind of attack, said Paul Mutton , a security analyst with Netcraft.
DNSSEC uses public key cryptography to digitally "sign" the DNS records for websites. It is designed to stop attacks such as cache poisoning, where a DNS server is hacked, making it possible for a user to type in the correct website name but be directed to a fake website.
"If the attacker was able to change the DNS settings held by the domain registrar, presumably they could also have changed other settings, such as disabling DNSSEC, or rather, simply change the DNS settings to point to nameservers that do not support DNSSEC."
NetNames described the attacks against its systems as being "sustained and concentrated." "We will continue to review our systems to ensure that we provide our customers a solid, robust and above all secure service," it said.
Send news tips and comments to firstname.lastname@example.org
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts