Feeds

DNS servers filled with wrong Kool-Aid, big names waylaid in Romania

Microsoft, Yahoo!, Google, PayPal all graffiti'd

High performance access to file storage

A hacker today redirected web surfers looking for Yahoo, Microsoft or Google to a page showing a TV test card by apparently poisoning Google's public DNS system.

Punters and organisations relying on Google's free service were affected, rather than the websites themselves being compromised.

Visitors to yahoo.ro, microsoft.ro and google.ro were served a message from an Algerian miscreant using the moniker MCA-CRB. Traffic destined for the Romanian websites of Kaspersky Lab and Paypal was also hijacked. Affected web browsers were pointed to a frankly boring message resembling nothing more than a test card and an animated GIF background.

MCA-CRB is a prolific online graffiti artist who has defaced at least 5,000 sites, according to records kept by Zone-H. The latest attack was carried out to gain bragging rights rather than to trouser a profit or stage a political protest.

Costin Raiu, a senior security researcher at Kaspersky Lab, said "the problem is with the Google free DNS servers (8.8.8.8, 8.8.4.4) not with the DNS servers for the specific domains". His colleague Stefan Tanase believes Google's public DNS servers were tricked into giving out the wrong IP addresses for the affected domains; one way this attack can be pulled off is by poisoning the web giant's DNS cache with bogus entries.

Other experts think the problem originates further up the food chain at Romania's TLD servers.

Catalin Cosoi, chief security strategist at Romanian antivirus firm Bitdefender, explained: "The breach appears to have initially originated at the Romanian TLD, from where the compromised DNS records propagated to DNS cache servers. We believe that the RoTLD breach was carried in a similar manner as in the Pakistani hack. It is only a supposition, but all signs point to the same group."

Last week, defaced copies of Google, Yahoo!, Microsoft, eBay and Apple's Pakistan websites were shown to surfers, again as a result of a DNS hijack. Hackers latched onto vulnerabilities at PKNIC, a Pakistani domain name registrar, and altered records to pull off the attack, Softpedia reported.

Access to the affected Romanian sites was restored by Wednesday lunchtime, except Paypal.ro which proved difficult to reach in any case.

DNS systems translate human-friendly domain names, such as theregister.co.uk, to internet addresses that routers and servers can understand and process. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.