Comcast Briefly Loses Control of Its Domain Name

Fallen Andy notes that Comcast, one of the largest US ISPs, lost control of its domain name to what appeared to be juvenile social engineers of the old school — i.e. not in it for the money. The intruders got into Comcast's registrar account at Network Solutions and repointed the domain's DNS records. A blog entry at SANS points out how trivially easy this can be. Reader ElvenKnight points out an insightful interview up at Wired with the two young guys who perpetrated the hack.

The consequences might not be as fun

the two kids who perpetrated the hack

How much do you bet the feds will come down hard on the kids and charge then with felony, cyber-"terrorism" or some other preposterous computer crime? I used to do harmless hacks for fun in years past, but these days it's not really wise.

Re:The consequences might not be as fun

How much do you bet the feds will come down hard on the kids and charge then with felony, cyber-"terrorism" or some other preposterous computer crime? I used to do harmless hacks for fun in years past, but these days it's not really wise.

That was hardly a "harmless hack". There is a lot of money tied to that domain and when it's down, it's a serious problem for a lot of people. That said, I agree that charging them as cyber-terrorists would be severe overkill.

Re:The consequences might not be as fun

It was a terrorist attack intended to disrupt a major part of the infrastructure, period.

Oh, really? You were there? You know what they were thinking? How do you know it wasn't a couple of punk kids just screwing around and not realizing what they were getting themselves into?

I never said they shouldn't be charged. I (and the parent I responded to) both just said that they will likely be charged with much more than the crime warrants.

Re:The consequences might not be as fun

since when "what they were thinking" is an excuse to break law?

It's not an excuse and that's why they should be charged with something. However, intent is a huge factor when determining what to charge someone with. For example, it's the difference between first degree murder and involuntary manslaughter. Either way, someone's dead, but one crime involves a possible death penalty for the perpetrator.

Re:The consequences might not be as fun

Since they invented the difference between first and second degree murder. Intent matters.

Re:The consequences might not be as fun

Since when did vandalism and theft become terrorism? The definition of terrorism has become so wide and vauge that anything that affects a group of people gets the terrorism lable slapped on it. It is like how the definitions of addiction or sex crime have become catch-all nets. Terrorism is a violent act intended to cause intimidation to achieve a goal. These kids just wanted to show off and feel powerful. I have no sympathy for them or their obnoxious, selfrightious attitudes but they aren't terrorists.

Re:The consequences might not be as fun

Man, if I had mod points you'd be getting -1 Terrorist for those kind of subversive opinions!

Re:The consequences might not be as fun

terrorism

You keep using that word. I do not think it means what you think it means. ...

Re:The consequences might not be as fun

It was a terrorist attack intended to disrupt a major part of the infrastructure, period.

Methinks you have an overly broad definition of "terrorist attack". One really ought not to put "couldn't check e-mail for 3 hours in the middle of the night" in the same category as the willful destruction of human life.

Re:The consequences might not be as fun

These days everything is a terrorist attack...Cause you know, I guess it's better to live in uninformed fear than to point out something foolish, cause the later would be unpatriotic and something terrorists do! >.>

Re:The consequences might not be as fun

A terrorist attack would imply one of two things. A) Someone got harmed or B) Terror was instilled in a mass population due to the threat of being harmed. Other than creating some headaches over at comcast for a few hours, no one was harmed. Get a grip on reality.

Re:The consequences might not be as fun

Excuse me but after seeing Rachel Ray in her Hamas video (don't tell me it was a scarf!) it is critical that we watch for 5th column terrorists everywhere. Fox News and all the other right-wing nut jobs told me so.

Excuse me while I listen to Barry Goldwater rolling in his grave.

Re:The consequences might not be as fun

I personally couldn't care less what they charge them with. If you going to do something so high profile you better expect that your punishment is going to be equally if not more so. I hope for them it was worth it.

Re:The consequences might not be as fun

I personally couldn't care less what they charge them with. If you going to do something so high profile you better expect that your punishment is going to be equally if not more so.

I think they've figured that out... now. From the Wired interview:

"The situation has kind of blown up here, a lot bigger than I thought it would," says Defiant, a 19-year-old man whose first name is James. "I wish I was a minor right now because this is going to be really bad."

They claim they called Comcast's technical contact and told him they'd taken control of the domain, BEFORE they changed anything. I don't know if it'll help them in court, but it sounds like if he hadn't blown them off, it really would have been a harmless prank. That doesn't justify their decision to redirect, but the Comcast guy should have at least bothered to check.

After they were blown off by him, these punks lost their tempers:

"I was trying to say we shouldn't do this the whole damn time," says Defiant.

"But once we were in," adds EBK, "it was, like, fuck it."

Well, I hope they had fun, because they're going to be paying for it, big time.

Re:The consequences might not be as fun

harvested logins of customers.

FTFA:

Fellow hackers, relying on press reports claiming that customer data may have been compromised, are hitting up the duo for passwords to Comcast e-mail accounts, which they say they don't have. "Nobody was listening in on the ports to try and get usernames and password," says Defiant. "We could have, but we didn't." (On this point, Comcast and the hackers agree).

Network Solutions seems to be the common trend.

Other websites that I know of have had this happen in the past, and the common trend seems to be that Network Solutions has been their domain registrar. The largest site in recent memory that this occurred to other than Comcast was SomethingAwful.

Perhaps it's a sign of a more underlying flaw in Network Solutions' security?

Everything old is new again.

Recent memory, my eye. This same thing happened to my old zine in 1999, and the trick was already old hat back then. We even published a how-to article about it, [phonelosers.net] since our specialty was old tricks everyone already thought were lame.

The best part: Network Solutions were of absolutely no help to us in getting our own domain back from the hijackers, so we ended up having to use the same trick to just steal it back again. Three times.

Re:Network Solutions seems to be the common trend.

From the Wired article:

Network Solutions spokeswoman Susan Wade disputes the hackers' account. "We now know that it was nothing on our end," she says. "There was no breach in our system or social engineering situation on our end."

Sooo, what she's saying is that Network Solutions' system was operating as designed. Is that supposed to be comforting?

These guys are my heroes

Wanna know why? Because they called Comcast and could get in touch with a HUMAN!

Now *THAT'S* hacking.

Re:These guys are my heroes

Try this: http://www.gethuman.com/gethuman_list.asp?bname=%22C%22 [gethuman.com]

Lazy companies create "automated systems to handle most inquiries" ignoring the fact that even their claim states its own failing, it doesn't handle them all. So we have created a database of how to circumvent the barrier to customer support.

Now if only we could force them to hire customer support grunts without such thick accents.

Re:These guys are my heroes

How come no one's made the obvious joke yet?

Comcast: OMG!!! Outrageous!!! Some HACKERS denied us access to our OWN DOMAIN NAME!!!! Get them!!!!
FBI: Why? They didn't take anything that belongs to you.
Comcast: What??? Out contract with ICANN gives us unlimited access to the Comcast domain!
FBI: Right. And what does unlimited mean?
Comcast: Look, it's right here in Websters: "without any ..."
FBI: No, no, not that one, use your own internal glossary.
Comcast: Okay then, "unlimited: " ... ah, okay, see your point there.

I know who did it...

It was the Slowskys [youtube.com].

Thats just sad....

not commenting on the hack, but the fact that a human being actually set up a tricorder in his(or his parents) bathroom to take a picture of himself using a bong, and then posted it on myspace.....

Re:Thats just sad....

And its even more sad when a person commenting on something being sad doesn't know the difference between "tripod" and "tricorder"

Re:Expiring domains

It wasn't even that Comcast's domain expired. The pair involved in this managed to gain access to Comcast's Network Solutions control panel and had full authoritative control over the domains.

Apparently, according to the linked articles, they pulled it off twice, too. This wasn't a case of "oh sweet, that's not registered anymore, yoink", it was a case of actual wresting of control.

The question is if the weakness in security lies with Comcast (i.e. a weak password for the panel) or Network Solutions (i.e. weakness in their portal, weak transmission of passwords, etc).