Slashdot Mirror
Want To Hijack a Domain? Just Get a Fax Machine
msm1267 writes "Metasploit's HD Moore says hackers sent a spoofed DNS change request via fax to Register.com that the registrar accepted, leading to a DNS hijacking attack against the Metasploit and Rapid7 websites. The two respective homepages were defaced with a message left by the same hacker collective that claimed responsibility for a similar DNS attack against Network Solutions. Rapid7 said the two sites' DNS records have been locked down and they are investigating."
Social engineering is not hacking to me.
What is the legal crime committed here, simply fraud?
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
There has been some commentary via mailing lists and Twitter feeds that this was not a big deal. Firstly, hats off to HD and his team, there was nothing they could have done about it. Secondly, this isn't to be taken lightly. Sure the attackers were minor script kiddies, but the reality is, the attack could have been extremely vicious. Consider an attacker replicating the content of the site and simply replacing the applications (nexpose, metasploit) with backdoored versions.
Companies like Register and GoDaddy are lacking in the validation category. ANYONE can create fake identification using GIMP, Photoshop, etc., the fact they did not offer anything other than a fax request is mind bogglingly stupid. They should have called BACK the registrant's number to confirm the change request. But, companies would argue: "that would be costly" not even thinking of turning that kind of validation into say a business model: "for $10 extra per year..." when they should be doing it from the jump. (Neither here nor there) Personally, I hadn't been running any updates, but if I did, I would be going back, wiping my machines, and re-installing.
"The DNS hijacking attack was resolved within an hour, Moore said."
Is that a DNS joke?
The only evidence actually quoted that the attack was by faxed change request is the defaced website. Do we trust the "hackers" that much that we believe they made the change by sending a fax? Could the group be giving a red herring?
It's "Canadian Hacking". Instead of breaking into someone's computers and maliciously altering their data, you just call them up or send a note to ask politely if they would do it to themselves.
You'd be surprised at how often it works, eh?
I recently moved. As I called the various utilities to tell them to cancel my service few of them asked for any kind of identification except my address. I other words in could easily shut off anyone's gas, electricity, internet service
On the other hand it's pretty nice to live in a society with so much trust
In 1999/2000 all we had to do to get a dns change from network solutions was fax in a request with a company letter head. They would change the new clients DNS to use and off we went.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Only if does it in English could have.
A legally-qualified friend of mine once told me that fax was officially regarded as a valid "service" in legal terms (i.e. you could send summons, court orders, etc. by it and count them as being served on someone).
There are rules for communications in legal terms, which basically say that if you replied to an email, then email is a valid form of service for you, and things like that, but fax had enjoys a special relationship with legal people for a long time. Hence some finance / legal departments will only accept things by fax sometimes, which although nonsensical in technical terms, has a good reason behind it.
I imagine the situation has changed with the advent of electronic court proceedings (according to what I was researching for preparation to sue my car insurance company, I am able to do virtually the entire case online nowadays, thanks to the UK Government Gateway authentication) but it still holds a few powers that courts will recognise but may not for things like email, messaging, etc.
I had to do this recently for a legitimate reason. A friend had bought a small hobby type operation (including the domain), but the old owner forgot to change the domain ownership over and dropped off the grid. It wasn't really a problem until we wanted to change hosting providers, at which point we couldn't update the DNS settings.
Since we actually had control of the domain, I used the account that was listed as the admin contact to send an email to the registrar explaining the situation and asking if they could change the info for us. Without any validation whatsoever they sent me the username and password (apparently stored in clear text) for the account, allowing me to do anything I wanted with it.
Thankfully I don't use that registrar for my own stuff. I expected at least to have to show some proof of ownership or something.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Actually, some contracts require you to have one.
That said, just buy a $49 modem and use it to be a "fax machine".
-- Tigger warning: This post may contain tiggers! --
The ironic part is that they probably take faxes because they're considered more secure than email. I mean if you have official looking letterhead, that means you must be legitimate, right?
I read the internet for the articles.
just to steal an internet domain?
> But we already HAD a word for that and it was not "hackers" it was con artists..
I think the distinction is in your last three words, "hacking a system".
A con man or fraudster will get a _person_ to hand over their property.
A hacker manipulates a _system_ to have it do something other than what it's supposed to do.
TFA says:
"The group was able to change the DNS records managed by Network Solutions for a number of security companies".
They did a number of companies by exploiting NetSol's SYSTEM, not simply tricking one person, but exploiting
holes in the system that the person what was part of. If you can fairly reliably exploit the system, it's a hack in my opinion whether that's a TCP/IP system, a phone system, a traffic light control system, or system that includes both
computers and human.
However, see also the Jargon File for original meanings of the term:
http://www.dourish.com/goodies/jargon.html
http://www.outpost9.com/reference/jargon/jargon_23.html#SEC30
I mean if you have official looking letterhead, that means you must be legitimate, right?
Thankfully, the days when our admin people wanted a fax on headed notepaper before they believed a business was legitimate are long gone. However, the ways that legitimate business people identify themselves to you are still very primitive. If you're lucky they send you a notification that you can pick up a PM. Banks are often the worst, where they robocall you and want you to provide personal details before they tell you why they called.
Changing a DNS record is small beer, though. Social engineering by fax can acheive much more than that: http://www.nbcnews.com/id/18251472/ns/us_news-crime_and_courts/t/prison-releases-felon-after-getting-phony-fax/
Defaced implies that they were changed on the server. That didn't happen. The domain was hijacked and the replacement pages were put up on another server.
Want so jail time with Bubba? Use a fax machine to steal someones domain.
Jack of all trades,master of none