Slashdot Mirror
Paraguayan ccTLD Hacked, Google.com.py Redirected, Internal Database Leaked
MrJones writes "Last February 20th, hackers supposedly from Iran accessed and modified (English) the www.NIC.py database, redirecting www.google.com.py to another site.
The hackers posted the whole NIC.py database containing full names, national ID numbers, street addresses, phone numbers, and more of registrants. This is not the first time (English) that NIC.py, managed by the 2 most respectful Computer Science Universities of Paraguay, was hacked. Since the entire database was released, local white hat hackers were able to calculate how much money NIC.py was making annually (English) by charging $44 US per .py domain.
The local CS community are urging the NIC.py administrators to do all whats possible to protect the .py domain names since the hack was done by exploiting a simple remote code execution vulnerability. If they can modify google.com.py, just imagine what they can do to banks and financial institutions. Maybe Google can helps us."
"managed by the 2 most respectful Computer Science Universities of Paraguay"
I'm all for politeness but I think something like this should probably be managed by the most respected Universities.
The Paraguayans are lazy about patching their security holes because the weather is so nice.
Hence the "Maybe Google can helps us". Why bother to leave the hammock yourself!
I hope it was a vulnerability in their Python code?
the 2 most respectful Computer Science Universities of Paraguay
Respectful is nice. Respected would be better.
systemd is Roko's Basilisk.
The bit about hymenless monkeys is intriguing. Newsletter?
Write failed: Broken pipe
The admins didn't fool the hacker when they used "passwordo" as root password.
You mean this February then. That was last week, not last year, therefore its misleading to say "last February".
People buying domains for that price without complaining is also a BIG part of the problem. Paraguay has one of the most expensive TLD 44 USD, and probable the worst service. This is not an isolated case, is the reality in many other areas in my country, paraguayans running a public service abusing of other paraguayans. More and more people are buying domains outside ".py" because of that, overpriced and poor quality of service.
A "bit"? The place is like the old north-american Wild West. All you need to do to bump into a criminal is entering the country.
Religion: The greatest weapon of mass destruction of all time
Nothing needs to be hacked to get that same estimate of revenue.
Just download their zone file and multiply by their annual. The zone file even tells you when they were registered and when they're registered until, allowing you to take account of public discounts for registration length.
It's still an upper bound; you don't know what other offers or freebies are in there. But still. It's a better upper bound than the hack ostensibly provides.
StoneCypher is Full of BS
Lessons still not learned.