Potty-mouthed hackers steal comcast.net keys, go for a spin

Users redirected to rogue site

By Dan Goodin in San Francisco • Get more from this author

Posted in Telecoms, 29th May 2008 19:19 GMT

Understand how application security is evolving

Unknown hackers hijacked Comcast's domain name for three hours overnight, sending subscribers who tried to access webmail and other services to a rogue site that bragged of the exploit.

Comcast lost control of the comcast.net address after the attackers changed registration information stored by its domain registrar, Network Solutions, a Comcast spokesman said. The unauthorized change redirected people attempting to visit the site to a page that read: "KRYOGENIKS Defiant and EBK RoXed COMCAST. sHouTz To VIRUS Warlock elul21 coll1er seven." The page was displayed after the attackers altered the site's IP resolution information, replacing Comcast's IP address with the rogue address 209.62.20.186.

Comcast spokesman Charlie Douglas said there was no immediate evidence that the attackers' page tried to install malware or steal user credentials. But some participants in this DSLReports forum reported their email clients were redirected to the impostor address, prompting concern their login sequence could have been intercepted. Douglas said security people are still investigating.

Comcast engineers restored the correct domain name settings about three hours after they were altered. By late Thursday morning, comcast.net was accessible to most people. But some users, including some with private DNS servers that hadn't been updated, still got errors. (Windows users who are getting errors may want to try flushing their DNS cache using using the command "ipconfig /flushdns", sans the quotes.)

It's still unclear how the attackers accessed the registration settings on store with Network Solutions. A brute force password attack is one possibility, but you'd think Network Solutions has safeguards in place to detect thousands of unsuccessful login attempts. A Network Solutions spokeswoman said the company is working with Comcast to figure out how the hackers obtained the login credentials to the account.

The ability of unknown hackers to hijack the domain name of one of America's biggest internet providers is yet another reminder of the fragility of the net's domain name system. While DNS attacks in recent years have focused on more esoteric methods such as cache poisoning and DNS rebinding, the attack shows that old-fashioned account compromises are also sufficient to alter substantial amounts of web traffic.

Douglas said Comcast is working with unnamed law enforcement agencies to track down the attackers.

Little is known about the interlopers, except for a few traces left behind that hint at some sophomoric sensibilities. In addition to their cryptic defacement, they altered the address for Comcast's administrative contact to "69 dick tard lane, dildo room." ®

See what The Register's experts have to say on application security