Attacks/Breaches
12/18/2009
02:12 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Twitter Hit By DNS Hijacking Attack

Twitter site redirected to 'Iranian Cyber Army' Website for about an hour last night

In what at first appeared to be a compromise of Twitters servers, users to the site were greeted with the message "This site has been hacked by Iranian Cyber Army" for about an hour late last night.

Twitter later reported that its DNS records, not its servers, had instead been temporarily compromised. "As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we've investigated more fully," read Twitter's blog post.

Security experts say it appears to have been a DNS hijacking attack and was mostly used for hacktivism. Twitter users were just redirected to the hacktivists' site, but it could have been much worse. "These sorts of attacks are usually limited to hacktivism activities like this one today, but imagine the potential to criminals if they could pull this off against any site requiring log in credentials, such as PayPal, eBay, MSN, Facebook," blogged Rik Ferguson, solutions architect for Trend Micro. "One has to wonder how quickly the attack would be noted if the dummy site was an exact replica of the victim and was simply there to harvest credentials and redirect the user then into the real site."

Beth Jones, security analyst at Sophos, says the "Iranian Cyber Army" site contained no malware, and it's very likely that Twitter's servers remained untouched in the attack. "It looks like they just hacked the registrar to redirect traffic," says Jones, who notes that Sophos sees a new Website compromise every 3.6 seconds.

Just how the hackers changed the DNS records for twitter.com remains a mystery. And apparently Twitter was just one site affected by the compromise. Trend Micro's Ferguson says he found via a search other Websites displaying the same content.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, blogged today that it appears the hosting company for the DNS servers, BlueHost, may have been compromised. "In my opinion, it looks like that server was compromised via WordPress vulnerabilities, but that is just an educated guess based on content at this time. So, it looks like the hacker first hacked one of the sites on the Bluehost box, other mowjcamp.org, wpcrowd.com, or coventryri.com, then redirected all the twitter traffic to that IP by changing the Nameserver entries for Twitter to point away from their normal Google-provided IP addresses to 66.147.242.88 instead," he blogged.

But Rod Rasmussen, president at Internet Identity, says his firm watched the attackers move the redirect from server to server several times, so it was not just BlueHost servers that were affected. Rasmussen says it appears the attackers had a user name and password for a DynDNS account, from which they changed the DNS record resolution for Twitter.

"On the face of it, it seems more like hacktivism. But it could be a cover for doing something more -- it's hard to tell," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?