Attacks/Breaches
8/28/2013
09:25 AM
50%
50%

NY Times Caught In Syrian Hacker Attack

Hacks amount to "warning shots," threatening more widespread cyberattacks should the U.S. and allies launch military campaign against Syria, warns security expert.

AlienVault's Jaime Blasco posted a full list of sites that appeared to be redirecting to an SEA server, including not just the Times site but also Twitter and Huffington Post sites with a top-level U.K. domain name.

Throughout Tuesday, administrators for the Times played ping-pong with the SEA, as each side continued to update the DNS settings. CloudFlare CEO Matthew Prince said his company was helping the Times clean up the mess, and Tuesday turned to "two of the largest recursive DNS providers: OpenDNS and Google" to help prevent users from being redirected by malicious sites. "Technical teams from CloudFlare, OpenDNS and Google jumped on a conference call and discovered what appeared to be malware on the site to which the NYTimes.com site was redirected," Prince said in a blog post Tuesday. "OpenDNS and Google's DNS team worked to correct the hacked records for the customers of their recursive DNS services."

Numerous other sites -- including Google.com, Microsoft.com and Yahoo.com -- are also registered through Melbourne IT, raising the prospect that the SEA might still be able to trigger more widespread outages. "These other domains show no indication of being compromised, but if the attackers have found a weakness in the Melbourne IT system, these other domains may also be at risk," Moore told Mashable.

Melbourne IT said it traced the attack to a valid account at a U.S. reseller. "What we do know is that a valid username and password were used to access our systems," Melbourne IT's chief executive, Theo Hnarakis, told Australia's Financial Review Wednesday. "As far as the cause and how these perpetrators secured the name, we are not sure. We are still working with the reseller in the U.S. to work out exactly what's happening and whether it's a vulnerability on our side, on their side or with the customer."

According to a statement released by Melbourne IT, not all of the SEA's DNS hacking attempts were successful, thanks to some customers having used optional security controls. "For mission critical names we recommend that domain name owners take advantage of additional registry lock features available from domain name registries including .com -- some of the domain names targeted on the reseller account had these lock features active and were thus not affected," it said.

Any sites that may be targeted by the SEA would do well to heed that DNS security advice, especially since the group may soon ramp up its online attacks.

According to the United Nations, the two-year-old Syrian civil war has claimed more than 100,000 lives. Many Middle Eastern commentators see the conflict as a proxy war, with the winner set to gain an edge in regional power. Bloomberg reported in June that the U.S. and its allies declined to enter the Syrian conflict, believing that Assad's days were numbered. Instead, with the backing of Iran, his regime has posted notable gains.

But the prospect of imminent military intervention in Syria appears now all but certain after the the Arab League Tuesday condemned the Syrian government for last week's chemical attack, as well as two years of its "crimes of genocide." The 22-member organization urged the UN Security Council to act, and said that it "demands that all the perpetrators of this heinous crime be presented for international trials."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/29/2013 | 5:55:15 PM
re: NY Times Caught In Syrian Hacker Attack
So is cleaning up this mess - do you think there will be changes made by registrars as a result? Or, that at least customers should demand checks on their entries?
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
8/29/2013 | 2:34:42 AM
re: NY Times Caught In Syrian Hacker Attack
That would require work on the part of the registrar.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/28/2013 | 4:23:24 PM
re: NY Times Caught In Syrian Hacker Attack
Why isn't locking the default for any DNS entry? Or at the very least, shouldn't there be a check in place requiring two signoffs?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-0598
Published: 2015-03-05
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.

CVE-2015-0607
Published: 2015-03-05
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0657
Published: 2015-03-05
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.