Slashdot Mirror
Paraguayan ccTLD Hacked, Google.com.py Redirected, Internal Database Leaked
MrJones writes "Last February 20th, hackers supposedly from Iran accessed and modified (English) the www.NIC.py database, redirecting www.google.com.py to another site.
The hackers posted the whole NIC.py database containing full names, national ID numbers, street addresses, phone numbers, and more of registrants. This is not the first time (English) that NIC.py, managed by the 2 most respectful Computer Science Universities of Paraguay, was hacked. Since the entire database was released, local white hat hackers were able to calculate how much money NIC.py was making annually (English) by charging $44 US per .py domain.
The local CS community are urging the NIC.py administrators to do all whats possible to protect the .py domain names since the hack was done by exploiting a simple remote code execution vulnerability. If they can modify google.com.py, just imagine what they can do to banks and financial institutions. Maybe Google can helps us."
How does this affect me, Bender?
"managed by the 2 most respectful Computer Science Universities of Paraguay"
I'm all for politeness but I think something like this should probably be managed by the most respected Universities.
The Paraguayans are lazy about patching their security holes because the weather is so nice.
I hope it was a vulnerability in their Python code?
the 2 most respectful Computer Science Universities of Paraguay
Respectful is nice. Respected would be better.
systemd is Roko's Basilisk.
The bit about hymenless monkeys is intriguing. Newsletter?
Write failed: Broken pipe
let us have at it they whine. we can extract what's left of jagger out of that mess. we could make him smaller, quieter, younger,,, we have his digits....
enter the jaggerwire. the result of dna salvaged at the lhc composting accident. it may look like just another monkey, but this ape was built to escape. never stops moving, big lips, wavy hips, no hymen to answer for or be held hostage by, she rocks....
The admins didn't fool the hacker when they used "passwordo" as root password.
we call her cyndi http://www.youtube.com/watch?v... so time space & circumstance stability is an illusion for sure. for sure we've been here before?
Slashdot only allows anonymous users to post 10 times per day (more or less, depending on moderation). A user from your IP has already shared his or her thoughts with us that many times so rock on /.
You mean this February then. That was last week, not last year, therefore its misleading to say "last February".
You've clearly never been.
People buying domains for that price without complaining is also a BIG part of the problem. Paraguay has one of the most expensive TLD 44 USD, and probable the worst service. This is not an isolated case, is the reality in many other areas in my country, paraguayans running a public service abusing of other paraguayans. More and more people are buying domains outside ".py" because of that, overpriced and poor quality of service.
as if universities ever had enough money to run it services properly.
A "bit"? The place is like the old north-american Wild West. All you need to do to bump into a criminal is entering the country.
Religion: The greatest weapon of mass destruction of all time
Nothing needs to be hacked to get that same estimate of revenue.
Just download their zone file and multiply by their annual. The zone file even tells you when they were registered and when they're registered until, allowing you to take account of public discounts for registration length.
It's still an upper bound; you don't know what other offers or freebies are in there. But still. It's a better upper bound than the hack ostensibly provides.
StoneCypher is Full of BS
Lessons still not learned.