Feeds

Potty-mouthed hackers steal comcast.net keys, go for a spin

Users redirected to rogue site

Top 5 reasons to deploy VMware with Tegile

Unknown hackers hijacked Comcast's domain name for three hours overnight, sending subscribers who tried to access webmail and other services to a rogue site that bragged of the exploit.

Comcast lost control of the comcast.net address after the attackers changed registration information stored by its domain registrar, Network Solutions, a Comcast spokesman said. The unauthorized change redirected people attempting to visit the site to a page that read: "KRYOGENIKS Defiant and EBK RoXed COMCAST. sHouTz To VIRUS Warlock elul21 coll1er seven." The page was displayed after the attackers altered the site's IP resolution information, replacing Comcast's IP address with the rogue address 209.62.20.186.

Comcast spokesman Charlie Douglas said there was no immediate evidence that the attackers' page tried to install malware or steal user credentials. But some participants in this DSLReports forum reported their email clients were redirected to the impostor address, prompting concern their login sequence could have been intercepted. Douglas said security people are still investigating.

Comcast engineers restored the correct domain name settings about three hours after they were altered. By late Thursday morning, comcast.net was accessible to most people. But some users, including some with private DNS servers that hadn't been updated, still got errors. (Windows users who are getting errors may want to try flushing their DNS cache using using the command "ipconfig /flushdns", sans the quotes.)

It's still unclear how the attackers accessed the registration settings on store with Network Solutions. A brute force password attack is one possibility, but you'd think Network Solutions has safeguards in place to detect thousands of unsuccessful login attempts. A Network Solutions spokeswoman said the company is working with Comcast to figure out how the hackers obtained the login credentials to the account.

The ability of unknown hackers to hijack the domain name of one of America's biggest internet providers is yet another reminder of the fragility of the net's domain name system. While DNS attacks in recent years have focused on more esoteric methods such as cache poisoning and DNS rebinding, the attack shows that old-fashioned account compromises are also sufficient to alter substantial amounts of web traffic.

Douglas said Comcast is working with unnamed law enforcement agencies to track down the attackers.

Little is known about the interlopers, except for a few traces left behind that hint at some sophomoric sensibilities. In addition to their cryptic defacement, they altered the address for Comcast's administrative contact to "69 dick tard lane, dildo room." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Of COURSE Stephen Elop's to blame for Nokia woes, says author
'Google did have some unique propositions for Nokia'
FCC, Google cast eye over millimetre wireless
The smaller the wave, the bigger 5G's chances of success
It's even GRIMMER up North after MEGA SKY BROADBAND OUTAGE
By 'eck! Eccles cake production thrown into jeopardy
Mobile coverage on trains really is pants
You thought it was just *insert your provider here*, but now we have numbers
Don't mess with Texas ('cos it's getting Google Fiber and you're not)
A bit late, but company says 1Gbps Austin network almost ready to compete with AT&T
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.