Want To Hijack a Domain? Just Get a Fax Machine 162
msm1267 writes "Metasploit's HD Moore says hackers sent a spoofed DNS change request via fax to Register.com that the registrar accepted, leading to a DNS hijacking attack against the Metasploit and Rapid7 websites. The two respective homepages were defaced with a message left by the same hacker collective that claimed responsibility for a similar DNS attack against Network Solutions. Rapid7 said the two sites' DNS records have been locked down and they are investigating."
"hack" (Score:5, Insightful)
Social engineering is not hacking to me.
legal crime (Score:4, Insightful)
What is the legal crime committed here, simply fraud?
Re:"hack" (Score:5, Insightful)
What is the difference between injecting code into a machine to make it do what you want, and injecting an idea into a human to make the human do what you want.
A hack is not just a hack (Score:5, Insightful)
There has been some commentary via mailing lists and Twitter feeds that this was not a big deal. Firstly, hats off to HD and his team, there was nothing they could have done about it. Secondly, this isn't to be taken lightly. Sure the attackers were minor script kiddies, but the reality is, the attack could have been extremely vicious. Consider an attacker replicating the content of the site and simply replacing the applications (nexpose, metasploit) with backdoored versions.
Companies like Register and GoDaddy are lacking in the validation category. ANYONE can create fake identification using GIMP, Photoshop, etc., the fact they did not offer anything other than a fax request is mind bogglingly stupid. They should have called BACK the registrant's number to confirm the change request. But, companies would argue: "that would be costly" not even thinking of turning that kind of validation into say a business model: "for $10 extra per year..." when they should be doing it from the jump. (Neither here nor there) Personally, I hadn't been running any updates, but if I did, I would be going back, wiping my machines, and re-installing.
Re:"hack" (Score:4, Insightful)
Hackers also go bowling and put bumper stickers on cars. But few call those activities hacking. Just like few call rescueing kittens- firefighting.
Comment removed (Score:5, Insightful)
Re:"hack" (Score:4, Insightful)
"If manipulating people into doing things they wouldn't normally do is what you consider a "normal relationship", then you just might be sociopath."
Or just a talented salesperson.
Re:Registrar security is kind of a joke sometimes (Score:2, Insightful)
Which registrar was this? I would like to know so that I can avoid them in the future.