Attacks/Breaches
8/28/2013
09:25 AM
Connect Directly
RSS
E-Mail
50%
50%

NY Times Caught In Syrian Hacker Attack

Hacks amount to "warning shots," threatening more widespread cyberattacks should the U.S. and allies launch military campaign against Syria, warns security expert.

AlienVault's Jaime Blasco posted a full list of sites that appeared to be redirecting to an SEA server, including not just the Times site but also Twitter and Huffington Post sites with a top-level U.K. domain name.

Throughout Tuesday, administrators for the Times played ping-pong with the SEA, as each side continued to update the DNS settings. CloudFlare CEO Matthew Prince said his company was helping the Times clean up the mess, and Tuesday turned to "two of the largest recursive DNS providers: OpenDNS and Google" to help prevent users from being redirected by malicious sites. "Technical teams from CloudFlare, OpenDNS and Google jumped on a conference call and discovered what appeared to be malware on the site to which the NYTimes.com site was redirected," Prince said in a blog post Tuesday. "OpenDNS and Google's DNS team worked to correct the hacked records for the customers of their recursive DNS services."

Numerous other sites -- including Google.com, Microsoft.com and Yahoo.com -- are also registered through Melbourne IT, raising the prospect that the SEA might still be able to trigger more widespread outages. "These other domains show no indication of being compromised, but if the attackers have found a weakness in the Melbourne IT system, these other domains may also be at risk," Moore told Mashable.

Melbourne IT said it traced the attack to a valid account at a U.S. reseller. "What we do know is that a valid username and password were used to access our systems," Melbourne IT's chief executive, Theo Hnarakis, told Australia's Financial Review Wednesday. "As far as the cause and how these perpetrators secured the name, we are not sure. We are still working with the reseller in the U.S. to work out exactly what's happening and whether it's a vulnerability on our side, on their side or with the customer."

According to a statement released by Melbourne IT, not all of the SEA's DNS hacking attempts were successful, thanks to some customers having used optional security controls. "For mission critical names we recommend that domain name owners take advantage of additional registry lock features available from domain name registries including .com -- some of the domain names targeted on the reseller account had these lock features active and were thus not affected," it said.

Any sites that may be targeted by the SEA would do well to heed that DNS security advice, especially since the group may soon ramp up its online attacks.

According to the United Nations, the two-year-old Syrian civil war has claimed more than 100,000 lives. Many Middle Eastern commentators see the conflict as a proxy war, with the winner set to gain an edge in regional power. Bloomberg reported in June that the U.S. and its allies declined to enter the Syrian conflict, believing that Assad's days were numbered. Instead, with the backing of Iran, his regime has posted notable gains.

But the prospect of imminent military intervention in Syria appears now all but certain after the the Arab League Tuesday condemned the Syrian government for last week's chemical attack, as well as two years of its "crimes of genocide." The 22-member organization urged the UN Security Council to act, and said that it "demands that all the perpetrators of this heinous crime be presented for international trials."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/29/2013 | 5:55:15 PM
re: NY Times Caught In Syrian Hacker Attack
So is cleaning up this mess - do you think there will be changes made by registrars as a result? Or, that at least customers should demand checks on their entries?
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
8/29/2013 | 2:34:42 AM
re: NY Times Caught In Syrian Hacker Attack
That would require work on the part of the registrar.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/28/2013 | 4:23:24 PM
re: NY Times Caught In Syrian Hacker Attack
Why isn't locking the default for any DNS entry? Or at the very least, shouldn't there be a check in place requiring two signoffs?
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5142
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

CVE-2010-5302
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

CVE-2010-5303
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

CVE-2014-3562
Published: 2014-08-21
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

CVE-2014-3577
Published: 2014-08-21
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.