Feeds

Potty-mouthed hackers steal comcast.net keys, go for a spin

Users redirected to rogue site

Top 5 reasons to deploy VMware with Tegile

Unknown hackers hijacked Comcast's domain name for three hours overnight, sending subscribers who tried to access webmail and other services to a rogue site that bragged of the exploit.

Comcast lost control of the comcast.net address after the attackers changed registration information stored by its domain registrar, Network Solutions, a Comcast spokesman said. The unauthorized change redirected people attempting to visit the site to a page that read: "KRYOGENIKS Defiant and EBK RoXed COMCAST. sHouTz To VIRUS Warlock elul21 coll1er seven." The page was displayed after the attackers altered the site's IP resolution information, replacing Comcast's IP address with the rogue address 209.62.20.186.

Comcast spokesman Charlie Douglas said there was no immediate evidence that the attackers' page tried to install malware or steal user credentials. But some participants in this DSLReports forum reported their email clients were redirected to the impostor address, prompting concern their login sequence could have been intercepted. Douglas said security people are still investigating.

Comcast engineers restored the correct domain name settings about three hours after they were altered. By late Thursday morning, comcast.net was accessible to most people. But some users, including some with private DNS servers that hadn't been updated, still got errors. (Windows users who are getting errors may want to try flushing their DNS cache using using the command "ipconfig /flushdns", sans the quotes.)

It's still unclear how the attackers accessed the registration settings on store with Network Solutions. A brute force password attack is one possibility, but you'd think Network Solutions has safeguards in place to detect thousands of unsuccessful login attempts. A Network Solutions spokeswoman said the company is working with Comcast to figure out how the hackers obtained the login credentials to the account.

The ability of unknown hackers to hijack the domain name of one of America's biggest internet providers is yet another reminder of the fragility of the net's domain name system. While DNS attacks in recent years have focused on more esoteric methods such as cache poisoning and DNS rebinding, the attack shows that old-fashioned account compromises are also sufficient to alter substantial amounts of web traffic.

Douglas said Comcast is working with unnamed law enforcement agencies to track down the attackers.

Little is known about the interlopers, except for a few traces left behind that hint at some sophomoric sensibilities. In addition to their cryptic defacement, they altered the address for Comcast's administrative contact to "69 dick tard lane, dildo room." ®

Security for virtualized datacentres

More from The Register

next story
TEEN RAMPAGE: Kids in iPhone 6 'Will it bend' YouTube 'prank'
iPhones bent in Norwich? As if the place wasn't weird enough
Consumers agree to give up first-born child for free Wi-Fi – survey
This Herod network's ace – but crap reception in bullrushes
Crouching tiger, FAST ASLEEP dragon: Smugglers can't shift iPhone 6s
China's grey market reports 'sluggish' sales of Apple mobe
Sea-Me-We 5 construction starts
New sub cable to go live 2016
New EU digi-commish struggles with concepts of net neutrality
Oettinger all about the infrastructure – but not big on substance
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
EE coughs to BROKEN data usage metrics BLUNDER that short-changes customers
Carrier apologises for 'inflated' measurements cockup
Comcast: Help, help, FCC. Netflix and pals are EXTORTIONISTS
The others guys are being mean so therefore ... monopoly all good, yeah?
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.