Attacks/Breaches
12/18/2009
02:12 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Twitter Hit By DNS Hijacking Attack

Twitter site redirected to 'Iranian Cyber Army' Website for about an hour last night

In what at first appeared to be a compromise of Twitters servers, users to the site were greeted with the message "This site has been hacked by Iranian Cyber Army" for about an hour late last night.

Twitter later reported that its DNS records, not its servers, had instead been temporarily compromised. "As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we've investigated more fully," read Twitter's blog post.

Security experts say it appears to have been a DNS hijacking attack and was mostly used for hacktivism. Twitter users were just redirected to the hacktivists' site, but it could have been much worse. "These sorts of attacks are usually limited to hacktivism activities like this one today, but imagine the potential to criminals if they could pull this off against any site requiring log in credentials, such as PayPal, eBay, MSN, Facebook," blogged Rik Ferguson, solutions architect for Trend Micro. "One has to wonder how quickly the attack would be noted if the dummy site was an exact replica of the victim and was simply there to harvest credentials and redirect the user then into the real site."

Beth Jones, security analyst at Sophos, says the "Iranian Cyber Army" site contained no malware, and it's very likely that Twitter's servers remained untouched in the attack. "It looks like they just hacked the registrar to redirect traffic," says Jones, who notes that Sophos sees a new Website compromise every 3.6 seconds.

Just how the hackers changed the DNS records for twitter.com remains a mystery. And apparently Twitter was just one site affected by the compromise. Trend Micro's Ferguson says he found via a search other Websites displaying the same content.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, blogged today that it appears the hosting company for the DNS servers, BlueHost, may have been compromised. "In my opinion, it looks like that server was compromised via WordPress vulnerabilities, but that is just an educated guess based on content at this time. So, it looks like the hacker first hacked one of the sites on the Bluehost box, other mowjcamp.org, wpcrowd.com, or coventryri.com, then redirected all the twitter traffic to that IP by changing the Nameserver entries for Twitter to point away from their normal Google-provided IP addresses to 66.147.242.88 instead," he blogged.

But Rod Rasmussen, president at Internet Identity, says his firm watched the attackers move the redirect from server to server several times, so it was not just BlueHost servers that were affected. Rasmussen says it appears the attackers had a user name and password for a DynDNS account, from which they changed the DNS record resolution for Twitter.

"On the face of it, it seems more like hacktivism. But it could be a cover for doing something more -- it's hard to tell," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.