Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

NY Times Caught In Syrian Hacker Attack

Hacks amount to "warning shots," threatening more widespread cyberattacks should the U.S. and allies launch military campaign against Syria, warns security expert.

AlienVault's Jaime Blasco posted a full list of sites that appeared to be redirecting to an SEA server, including not just the Times site but also Twitter and Huffington Post sites with a top-level U.K. domain name.

Throughout Tuesday, administrators for the Times played ping-pong with the SEA, as each side continued to update the DNS settings. CloudFlare CEO Matthew Prince said his company was helping the Times clean up the mess, and Tuesday turned to "two of the largest recursive DNS providers: OpenDNS and Google" to help prevent users from being redirected by malicious sites. "Technical teams from CloudFlare, OpenDNS and Google jumped on a conference call and discovered what appeared to be malware on the site to which the NYTimes.com site was redirected," Prince said in a blog post Tuesday. "OpenDNS and Google's DNS team worked to correct the hacked records for the customers of their recursive DNS services."

Numerous other sites -- including Google.com, Microsoft.com and Yahoo.com -- are also registered through Melbourne IT, raising the prospect that the SEA might still be able to trigger more widespread outages. "These other domains show no indication of being compromised, but if the attackers have found a weakness in the Melbourne IT system, these other domains may also be at risk," Moore told Mashable.

Melbourne IT said it traced the attack to a valid account at a U.S. reseller. "What we do know is that a valid username and password were used to access our systems," Melbourne IT's chief executive, Theo Hnarakis, told Australia's Financial Review Wednesday. "As far as the cause and how these perpetrators secured the name, we are not sure. We are still working with the reseller in the U.S. to work out exactly what's happening and whether it's a vulnerability on our side, on their side or with the customer."

According to a statement released by Melbourne IT, not all of the SEA's DNS hacking attempts were successful, thanks to some customers having used optional security controls. "For mission critical names we recommend that domain name owners take advantage of additional registry lock features available from domain name registries including .com -- some of the domain names targeted on the reseller account had these lock features active and were thus not affected," it said.

Any sites that may be targeted by the SEA would do well to heed that DNS security advice, especially since the group may soon ramp up its online attacks.

According to the United Nations, the two-year-old Syrian civil war has claimed more than 100,000 lives. Many Middle Eastern commentators see the conflict as a proxy war, with the winner set to gain an edge in regional power. Bloomberg reported in June that the U.S. and its allies declined to enter the Syrian conflict, believing that Assad's days were numbered. Instead, with the backing of Iran, his regime has posted notable gains.

But the prospect of imminent military intervention in Syria appears now all but certain after the the Arab League Tuesday condemned the Syrian government for last week's chemical attack, as well as two years of its "crimes of genocide." The 22-member organization urged the UN Security Council to act, and said that it "demands that all the perpetrators of this heinous crime be presented for international trials."

 

Recommended Reading:

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/29/2013 | 5:55:15 PM
re: NY Times Caught In Syrian Hacker Attack
So is cleaning up this mess - do you think there will be changes made by registrars as a result? Or, that at least customers should demand checks on their entries?
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
8/29/2013 | 2:34:42 AM
re: NY Times Caught In Syrian Hacker Attack
That would require work on the part of the registrar.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
8/28/2013 | 4:23:24 PM
re: NY Times Caught In Syrian Hacker Attack
Why isn't locking the default for any DNS entry? Or at the very least, shouldn't there be a check in place requiring two signoffs?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5974
PUBLISHED: 2020-07-08
NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges.
CVE-2020-15072
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
CVE-2020-15073
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVE-2020-2034
PUBLISHED: 2020-07-08
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect...
CVE-2019-19415
PUBLISHED: 2020-07-08
The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the a...