Attacks/Breaches
8/28/2013
09:25 AM
50%
50%

NY Times Caught In Syrian Hacker Attack

Hacks amount to "warning shots," threatening more widespread cyberattacks should the U.S. and allies launch military campaign against Syria, warns security expert.

AlienVault's Jaime Blasco posted a full list of sites that appeared to be redirecting to an SEA server, including not just the Times site but also Twitter and Huffington Post sites with a top-level U.K. domain name.

Throughout Tuesday, administrators for the Times played ping-pong with the SEA, as each side continued to update the DNS settings. CloudFlare CEO Matthew Prince said his company was helping the Times clean up the mess, and Tuesday turned to "two of the largest recursive DNS providers: OpenDNS and Google" to help prevent users from being redirected by malicious sites. "Technical teams from CloudFlare, OpenDNS and Google jumped on a conference call and discovered what appeared to be malware on the site to which the NYTimes.com site was redirected," Prince said in a blog post Tuesday. "OpenDNS and Google's DNS team worked to correct the hacked records for the customers of their recursive DNS services."

Numerous other sites -- including Google.com, Microsoft.com and Yahoo.com -- are also registered through Melbourne IT, raising the prospect that the SEA might still be able to trigger more widespread outages. "These other domains show no indication of being compromised, but if the attackers have found a weakness in the Melbourne IT system, these other domains may also be at risk," Moore told Mashable.

Melbourne IT said it traced the attack to a valid account at a U.S. reseller. "What we do know is that a valid username and password were used to access our systems," Melbourne IT's chief executive, Theo Hnarakis, told Australia's Financial Review Wednesday. "As far as the cause and how these perpetrators secured the name, we are not sure. We are still working with the reseller in the U.S. to work out exactly what's happening and whether it's a vulnerability on our side, on their side or with the customer."

According to a statement released by Melbourne IT, not all of the SEA's DNS hacking attempts were successful, thanks to some customers having used optional security controls. "For mission critical names we recommend that domain name owners take advantage of additional registry lock features available from domain name registries including .com -- some of the domain names targeted on the reseller account had these lock features active and were thus not affected," it said.

Any sites that may be targeted by the SEA would do well to heed that DNS security advice, especially since the group may soon ramp up its online attacks.

According to the United Nations, the two-year-old Syrian civil war has claimed more than 100,000 lives. Many Middle Eastern commentators see the conflict as a proxy war, with the winner set to gain an edge in regional power. Bloomberg reported in June that the U.S. and its allies declined to enter the Syrian conflict, believing that Assad's days were numbered. Instead, with the backing of Iran, his regime has posted notable gains.

But the prospect of imminent military intervention in Syria appears now all but certain after the the Arab League Tuesday condemned the Syrian government for last week's chemical attack, as well as two years of its "crimes of genocide." The 22-member organization urged the UN Security Council to act, and said that it "demands that all the perpetrators of this heinous crime be presented for international trials."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/29/2013 | 5:55:15 PM
re: NY Times Caught In Syrian Hacker Attack
So is cleaning up this mess - do you think there will be changes made by registrars as a result? Or, that at least customers should demand checks on their entries?
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
8/29/2013 | 2:34:42 AM
re: NY Times Caught In Syrian Hacker Attack
That would require work on the part of the registrar.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/28/2013 | 4:23:24 PM
re: NY Times Caught In Syrian Hacker Attack
Why isn't locking the default for any DNS entry? Or at the very least, shouldn't there be a check in place requiring two signoffs?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.