Attacks/Breaches
12/18/2009
02:12 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Twitter Hit By DNS Hijacking Attack

Twitter site redirected to 'Iranian Cyber Army' Website for about an hour last night

In what at first appeared to be a compromise of Twitters servers, users to the site were greeted with the message "This site has been hacked by Iranian Cyber Army" for about an hour late last night.

Twitter later reported that its DNS records, not its servers, had instead been temporarily compromised. "As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we've investigated more fully," read Twitter's blog post.

Security experts say it appears to have been a DNS hijacking attack and was mostly used for hacktivism. Twitter users were just redirected to the hacktivists' site, but it could have been much worse. "These sorts of attacks are usually limited to hacktivism activities like this one today, but imagine the potential to criminals if they could pull this off against any site requiring log in credentials, such as PayPal, eBay, MSN, Facebook," blogged Rik Ferguson, solutions architect for Trend Micro. "One has to wonder how quickly the attack would be noted if the dummy site was an exact replica of the victim and was simply there to harvest credentials and redirect the user then into the real site."

Beth Jones, security analyst at Sophos, says the "Iranian Cyber Army" site contained no malware, and it's very likely that Twitter's servers remained untouched in the attack. "It looks like they just hacked the registrar to redirect traffic," says Jones, who notes that Sophos sees a new Website compromise every 3.6 seconds.

Just how the hackers changed the DNS records for twitter.com remains a mystery. And apparently Twitter was just one site affected by the compromise. Trend Micro's Ferguson says he found via a search other Websites displaying the same content.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, blogged today that it appears the hosting company for the DNS servers, BlueHost, may have been compromised. "In my opinion, it looks like that server was compromised via WordPress vulnerabilities, but that is just an educated guess based on content at this time. So, it looks like the hacker first hacked one of the sites on the Bluehost box, other mowjcamp.org, wpcrowd.com, or coventryri.com, then redirected all the twitter traffic to that IP by changing the Nameserver entries for Twitter to point away from their normal Google-provided IP addresses to 66.147.242.88 instead," he blogged.

But Rod Rasmussen, president at Internet Identity, says his firm watched the attackers move the redirect from server to server several times, so it was not just BlueHost servers that were affected. Rasmussen says it appears the attackers had a user name and password for a DynDNS account, from which they changed the DNS record resolution for Twitter.

"On the face of it, it seems more like hacktivism. But it could be a cover for doing something more -- it's hard to tell," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-7839
Published: 2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVE-2014-8001
Published: 2014-11-25
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVE-2014-8002
Published: 2014-11-25
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?