Attacks/Breaches
8/29/2013
02:54 PM
50%
50%

Lessons Learned From N.Y. Times Hack Attack

How could the Times have recovered faster after the Syrian Electronic Army attacked its DNS registry? Here are six considerations to help protect your business from similar harm.

4. Employ DNS Registry Locks

Twitter -- but not the Times -- also subscribed to a registry lock service, which resembles a credit card fraud alert: Whenever someone attempts to do something suspicious, such as change DNS settings, the website owner receives an email alert. Such services cost as little as $50 per year, and are available from VeriSign and NeuStar. While the cost to the Times from the advertising revenue it lost as a result of the disruptions can't be tallied in full until its site is fully restored, the cost is likely to be orders of magnitude more expensive than a registry lock service subscription.

Why don't more registrars offer locking as an always-on service, layered with even better security controls? "The domain name registrars are trying to get better at doing things like this," said Carl Herberger, VP of security solutions for Radware, speaking by phone. "A lot of times there are complications in the way that they can actually accomplish their business. If you change the configuration it may break something."

In addition, using registry locks requires more effort when it comes to renewing domain names. Furthermore, what's to prevent an attacker from hacking into the registry lock provider?

5. Beware Simple Solutions

There is no silver bullet for preventing opportunistic attacks, and every new defense, such as registry locks, might create a potential new weakness, or require more effort. "At the end of the day, this was an integrity-based attack, and what I mean by that is they reconfigured the domain servers so they did different things," said Herberger. "So, to ensure the integrity of those different things, you're [now] going to lock those," referring to registry locking services. But what if someone attacks those services directly, or finds a way to cause long-term outages that leave customers unable to unlock settings?

Herberger added: "Whenever you centralize all of your security around fewer gatekeepers, you have the opportunity of a denial of service. That's the irony of it."

6. Be Prepared To Not Stop Every Attack

If attackers devote enough time and energy to finding a weakness that they can exploit with relatively low cost and little effort, then it will be almost impossible to stop them. "There's not a whole lot The New York Times can do if their third party DNS provider was hacked," said Ken Pickering, director of engineering at penetration testing firm CORE Security, via email. "The system is only really failsafe if DNS providers are unhackable, which obviously isn't the case. And this is the resultant outcome: A story that the NYT was hacked with very little they could do aside from picking a better service provider."

Furthermore, it's important to remember that the SEA -- graduating from its long-running Twitter account takeover activities -- found a new vulnerability to exploit. "They exposed some world-class exposures in some world-class environments," said Herberger. "To take down The New York Times website? Pretty impressive. To expose some security problems in Twitter, even if the rest of the world didn't know they were there? Very impressive."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
8/30/2013 | 1:23:15 PM
re: Lessons Learned From N.Y. Times Hack Attack
Is there something website operators can do to get visibility into all the subcontractor relationships between different organizations involved in the management and maintenance of DNS records? Seems like simplifying the chain of command might be one way to minimize the chance of problems like this.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2382
Published: 2014-11-20
The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations, related to the IofCallDriver function.

CVE-2014-3625
Published: 2014-11-20
Directory traversal vulnerability in Pivitol Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVE-2014-8387
Published: 2014-11-20
cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.

CVE-2014-8493
Published: 2014-11-20
ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/access_cwmp_1.

CVE-2014-8767
Published: 2014-11-20
Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?