Attacks/Breaches
12/18/2009
02:12 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Twitter Hit By DNS Hijacking Attack

Twitter site redirected to 'Iranian Cyber Army' Website for about an hour last night

In what at first appeared to be a compromise of Twitters servers, users to the site were greeted with the message "This site has been hacked by Iranian Cyber Army" for about an hour late last night.

Twitter later reported that its DNS records, not its servers, had instead been temporarily compromised. "As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we've investigated more fully," read Twitter's blog post.

Security experts say it appears to have been a DNS hijacking attack and was mostly used for hacktivism. Twitter users were just redirected to the hacktivists' site, but it could have been much worse. "These sorts of attacks are usually limited to hacktivism activities like this one today, but imagine the potential to criminals if they could pull this off against any site requiring log in credentials, such as PayPal, eBay, MSN, Facebook," blogged Rik Ferguson, solutions architect for Trend Micro. "One has to wonder how quickly the attack would be noted if the dummy site was an exact replica of the victim and was simply there to harvest credentials and redirect the user then into the real site."

Beth Jones, security analyst at Sophos, says the "Iranian Cyber Army" site contained no malware, and it's very likely that Twitter's servers remained untouched in the attack. "It looks like they just hacked the registrar to redirect traffic," says Jones, who notes that Sophos sees a new Website compromise every 3.6 seconds.

Just how the hackers changed the DNS records for twitter.com remains a mystery. And apparently Twitter was just one site affected by the compromise. Trend Micro's Ferguson says he found via a search other Websites displaying the same content.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, blogged today that it appears the hosting company for the DNS servers, BlueHost, may have been compromised. "In my opinion, it looks like that server was compromised via WordPress vulnerabilities, but that is just an educated guess based on content at this time. So, it looks like the hacker first hacked one of the sites on the Bluehost box, other mowjcamp.org, wpcrowd.com, or coventryri.com, then redirected all the twitter traffic to that IP by changing the Nameserver entries for Twitter to point away from their normal Google-provided IP addresses to 66.147.242.88 instead," he blogged.

But Rod Rasmussen, president at Internet Identity, says his firm watched the attackers move the redirect from server to server several times, so it was not just BlueHost servers that were affected. Rasmussen says it appears the attackers had a user name and password for a DynDNS account, from which they changed the DNS record resolution for Twitter.

"On the face of it, it seems more like hacktivism. But it could be a cover for doing something more -- it's hard to tell," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio