Attacks/Breaches
8/29/2013
02:54 PM
Connect Directly
RSS
E-Mail
50%
50%

Lessons Learned From N.Y. Times Hack Attack

How could the Times have recovered faster after the Syrian Electronic Army attacked its DNS registry? Here are six considerations to help protect your business from similar harm.

4. Employ DNS Registry Locks

Twitter -- but not the Times -- also subscribed to a registry lock service, which resembles a credit card fraud alert: Whenever someone attempts to do something suspicious, such as change DNS settings, the website owner receives an email alert. Such services cost as little as $50 per year, and are available from VeriSign and NeuStar. While the cost to the Times from the advertising revenue it lost as a result of the disruptions can't be tallied in full until its site is fully restored, the cost is likely to be orders of magnitude more expensive than a registry lock service subscription.

Why don't more registrars offer locking as an always-on service, layered with even better security controls? "The domain name registrars are trying to get better at doing things like this," said Carl Herberger, VP of security solutions for Radware, speaking by phone. "A lot of times there are complications in the way that they can actually accomplish their business. If you change the configuration it may break something."

In addition, using registry locks requires more effort when it comes to renewing domain names. Furthermore, what's to prevent an attacker from hacking into the registry lock provider?

5. Beware Simple Solutions

There is no silver bullet for preventing opportunistic attacks, and every new defense, such as registry locks, might create a potential new weakness, or require more effort. "At the end of the day, this was an integrity-based attack, and what I mean by that is they reconfigured the domain servers so they did different things," said Herberger. "So, to ensure the integrity of those different things, you're [now] going to lock those," referring to registry locking services. But what if someone attacks those services directly, or finds a way to cause long-term outages that leave customers unable to unlock settings?

Herberger added: "Whenever you centralize all of your security around fewer gatekeepers, you have the opportunity of a denial of service. That's the irony of it."

6. Be Prepared To Not Stop Every Attack

If attackers devote enough time and energy to finding a weakness that they can exploit with relatively low cost and little effort, then it will be almost impossible to stop them. "There's not a whole lot The New York Times can do if their third party DNS provider was hacked," said Ken Pickering, director of engineering at penetration testing firm CORE Security, via email. "The system is only really failsafe if DNS providers are unhackable, which obviously isn't the case. And this is the resultant outcome: A story that the NYT was hacked with very little they could do aside from picking a better service provider."

Furthermore, it's important to remember that the SEA -- graduating from its long-running Twitter account takeover activities -- found a new vulnerability to exploit. "They exposed some world-class exposures in some world-class environments," said Herberger. "To take down The New York Times website? Pretty impressive. To expose some security problems in Twitter, even if the rest of the world didn't know they were there? Very impressive."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
8/30/2013 | 1:23:15 PM
re: Lessons Learned From N.Y. Times Hack Attack
Is there something website operators can do to get visibility into all the subcontractor relationships between different organizations involved in the management and maintenance of DNS records? Seems like simplifying the chain of command might be one way to minimize the chance of problems like this.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.