Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google.com.pk and 284 Other .PK Domains Hacked

Posted by Soulskill on from the go-big-or-go-home dept.

ryzvonusef writes with news that hackers have taken down the local Pakistan versions of many popular websites, including google.com.pk, apple.pk, microsoft.pk and yahoo.pk. 284 sites were affected in total. Many of the sites were defaced, and a group called Eboz is taking credit for the hack. According to TechCrunch, "The root of today’s attack, it seems, came via a breach of Pakistan’s TLD operator, PKNIC, which administers and registers all .pk domains. Looking at affected organizations via PKNIC’s look up, it appears that all the sites are now redirecting to two nameservers, dns1.freehostia.com and dns2.freehostia.com."

9 of 35 comments (clear)

  1. Difference? by thej1nx · · Score: 2

    And here I thought the Pakistani courts and religious leaders kept passing orders anyways to censor domains, based on hearsay about "immoral stuff" to be found on them . Doubt poor pakistani netizens could tell the difference here.

  2. Its the TLD that was hacked by Anonymous Coward · · Score: 5, Insightful

    Blame the TLD operators, dont name google,etc who had no role in the hack

    1. Re:Its the TLD that was hacked by Runaway1956 · · Score: 4, Interesting

      I was sitting here scratching my head, wondering why all those sites were hosted by the same servers.

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
  3. Taken down and defaced? by Anonymous Coward · · Score: 5, Insightful

    I'm not great at networking knowledge, but if you simply redirect to a new IP, is the site really defaced?

    1. Re:Taken down and defaced? by ark1 · · Score: 3, Informative

      I'm not great at networking knowledge, but if you simply redirect to a new IP, is the site really defaced?

      From the end user perspective, site may appear as defaced but the actual web page at {Google, MS,....} is not defaced.

  4. One might say... by philip.paradis · · Score: 2

    One might say the entire TLD is PhuKed. The teachable moment here is that security rolls downhill, and depending on any single layer of public infrastructure, at least for authentication of who you're talking to without giving serious consideration to cryptographic concerns, is asking for trouble. This is still something that the world is failing at on, well, a global scale.

    Well, that and taking perimeter security seriously in terms of access to critical components, and having short order failover to components with completely different codebases ready to roll into production for select services in the event of something nasty happening. These days, virtualization on multiple platforms running in parallel makes that easier, although it does have the effect of acting as a cost multiplier (sliding scale factor-wise) depending on what you're trying to make as bulletproof as possible.

    TLDR = Security is hard. Be prepared to be compromised. Have alternate plans in place that assume at least one $major_thing is already silently compromised. Yeah, it's tough. Life is tough.

    --
    Write failed: Broken pipe
    1. Re:One might say... by heypete · · Score: 4, Interesting

      I'd imagine the NIC could simply revert to a backup of their TLD zone and undo the changes -- the zone itself isn't infected and in need of purging, though the systems that can write to it may well be. I would hope that a NIC managing a national-level TLD has backups.

      That said, how could any entity that relies on DNS have alternate plans to deal with this sort of thing? Its one thing to have off-site nameservers on a different network to provide some degree of fault tolerance for your own domain, but it's another thing if the TLD itself gets hosed and bad guys modify the zone to point at different nameservers. As far as I can tell there's no reasonable way for the holder of a domain name to prepare for the TLD getting compromised.

      I hope this incident serves as a wakeup call for TLD owners everywhere so they can review their security policies.

  5. Re:PKNIC unable to respond, PR team in picknick. by History's+Coming+To · · Score: 4, Funny

    Problem in Karachi Not In Computer?

    --
    Please consider this account deleted, I just can't be bothered with the spam anymore.
  6. In Ireland Google.ie and yahoo.ie were also hacked by Korth · · Score: 3, Interesting

    A similar thing happened in Ireland earlier this month due to a vulnerability in Joomla! http://www.iedr.ie/docs/IEDR_Statement_F_issued_9_November_2012.pdf