Attacks/Breaches
12/18/2009
02:12 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Twitter Hit By DNS Hijacking Attack

Twitter site redirected to 'Iranian Cyber Army' Website for about an hour last night

In what at first appeared to be a compromise of Twitters servers, users to the site were greeted with the message "This site has been hacked by Iranian Cyber Army" for about an hour late last night.

Twitter later reported that its DNS records, not its servers, had instead been temporarily compromised. "As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we've investigated more fully," read Twitter's blog post.

Security experts say it appears to have been a DNS hijacking attack and was mostly used for hacktivism. Twitter users were just redirected to the hacktivists' site, but it could have been much worse. "These sorts of attacks are usually limited to hacktivism activities like this one today, but imagine the potential to criminals if they could pull this off against any site requiring log in credentials, such as PayPal, eBay, MSN, Facebook," blogged Rik Ferguson, solutions architect for Trend Micro. "One has to wonder how quickly the attack would be noted if the dummy site was an exact replica of the victim and was simply there to harvest credentials and redirect the user then into the real site."

Beth Jones, security analyst at Sophos, says the "Iranian Cyber Army" site contained no malware, and it's very likely that Twitter's servers remained untouched in the attack. "It looks like they just hacked the registrar to redirect traffic," says Jones, who notes that Sophos sees a new Website compromise every 3.6 seconds.

Just how the hackers changed the DNS records for twitter.com remains a mystery. And apparently Twitter was just one site affected by the compromise. Trend Micro's Ferguson says he found via a search other Websites displaying the same content.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, blogged today that it appears the hosting company for the DNS servers, BlueHost, may have been compromised. "In my opinion, it looks like that server was compromised via WordPress vulnerabilities, but that is just an educated guess based on content at this time. So, it looks like the hacker first hacked one of the sites on the Bluehost box, other mowjcamp.org, wpcrowd.com, or coventryri.com, then redirected all the twitter traffic to that IP by changing the Nameserver entries for Twitter to point away from their normal Google-provided IP addresses to 66.147.242.88 instead," he blogged.

But Rod Rasmussen, president at Internet Identity, says his firm watched the attackers move the redirect from server to server several times, so it was not just BlueHost servers that were affected. Rasmussen says it appears the attackers had a user name and password for a DynDNS account, from which they changed the DNS record resolution for Twitter.

"On the face of it, it seems more like hacktivism. But it could be a cover for doing something more -- it's hard to tell," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-4801
Published: 2014-12-18
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iFix 2, and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.