6 ms·

Metasploit website hijacked via fax

60 points by robk 13y ago

cosmie 13y ago
What, no phone call to verify the changes with the account holder on file? I would have hoped that was standard procedure...
- mischanix 13y ago
  Phone verification may have been performed using a phone number listed on the fake fax, if at all.
  - cosmie 13y ago
    That was precisely my point, and why I'm so confused. You do not verify change requests with the change request, you verify it with details from the system of record. A classic example of this would be submitting a change of address to USPS or modifying an email address on an account. You don't verify that change with the new information, but rather by sending notification or confirmation to the previous address/email. The fact that a registrar wouldn't enforce such a process is... upsetting.
    - bradleyland 13y ago
      Preface: Ah, the smell of contempt in the morning! This post turned out to be pretty contemptible/cynical, but domain registration & management is a bit of a peeve of mine. I used to run an "IT consulting" company, and have thus developed the requisite jaded viewpoint from dealing with all of those customers who don't understand/value the responsibility of domain ownership. Every day, registrars are inundated with calls from incompetent domain owners who haven't kept their domain information up to date, and have lost control of their domain in some way or another. The registrars provide a process to recover your domain name, but that process relies heavily on human judgement. I think most programmers/technologists would be horrified at just how easily the process can be gamed. I've recovered no less than 5 domain names for friends/customers over the years, and I'm always shocked at how easy it is. If you can produce believable looking letterhead, and have done at least some cursory information gathering on the company in question, you can usually game the system. The reason this giant hole exists is because of customer service incentives. A large number of domain owners aren't responsible technology people. They're mom & pops, or some middle-manager who kind-of-sort-of understands the internet. They're people wearing many hats, and have never used a program like 1Password or LastPass to keep track of their important information. To add insult to injury, these same people are bombarded with fake domain renewal letters that result in their domain being hijacked by some shady business. The registrars end up handling the backside clean up for all of these incompetencies, and customers demand it. If a domain registrar began requiring the kind of verification that we'd expect, many people would simply lose their domain names and never do business with said registrar again. The registrars know this, so they make it (too) easy to recover a domain. IMO, there are two solutions: A regulatory body steps up and says: Domain owners are responsible for keeping your domain information and security credentials current. If you lose them, you will have to successfully navigate a lengthy and expensive verification process. The process will be standardized across the industry, and non-compliance will result in heft fines for the registrar. Alternatively, the option is given to domain registrants to treat their registration with a higher level of scrutiny. A kind of "I take responsibility" flag for your domain that significantly raises the bar for recovering the domain should you lose control of it. Neither of these will happen, because there is not enough incentive. The majority of domain owners will never be targeted in the manner illustrated here, so the service is unimportant to us. There aren't enough large companies to justify offering secure domain registration as a service. The rest of the world needs the easy recovery process because they're not competent/responsible enough to maintain control of their domain name.
ChuckMcM 13y ago
Remarkably powerful tool the FAX machine, to many bureaucracies have them connected directly into the brain.
ebilgenius 13y ago
Why are all these hackers pro-palestine?
- cma 13y ago
  If they were sampled evenly from world population, it would be what you would expect.
  - corin_ 13y ago
    Agreed, but that sample wouldn't get many people who shout out their opinion without being asked by it (a majority may support Palestine, but far less actively make their voices heard about it, on either side)
- BWStearns 13y ago
  Judging by the report it seems that these hackers ARE palestinian. One could easily conclude that Palestinians are likely to be sympathetic to the Palestinian cause.
- meowface 13y ago
  There are a lot of "hacktivist" groups based in Palestine, Iran, Egypt, and Syria.
michaelt 13y ago
Made me wonder what registrar major internet companies use. Fortunately, whois can tell us: facebook.com -> markmonitor google.com -> markmonitor amazon.com -> markmonitor youtube.com -> markmonitor yahoo.com -> markmonitor baidu.com -> markmonitor wikipedia.org -> markmonitor linkedin.com -> markmonitor ebay.com -> markmonitor bing.com -> markmonitor microsoft.com -> markmonitor paypal.com -> markmonitor flickr.com -> markmonitor blogger.com -> markmonitor wordpress.com -> markmonitor live.com -> corporatedomains twitter.com -> corporatedomains apple.com -> corporatedomains cnn.com -> corporatedomains theguardian.com -> tucows TinyURL.com -> tucows theguardian.com -> tucows huffingtonpost.com -> melbourneit t.co -> melbourneit bitly.com -> godaddy barackobama.com -> godaddy dell.com -> safenames reddit.com -> gandi imgur.com -> enom ycombinator.com -> easydns craigslist.org -> netsol I don't know whether markmonitor deliberately try to get popular websites as clients, aiming for some sort of halo effect.
- dmix 13y ago
  melbourneit recently famous from the Syrian Electronic Army social engineering "hack" bringing down or defacing multiple sites including the NYTimes.com, where it is hosted. http://www.pcmag.com/article2/0,2817,2423699,00.asp http://www.pcmag.com/article2/0,2817,2423699,00.asp
- pallandt 13y ago
  MarkMonitor is used by companies that are interested in protecting their brand(s) online. For example, imagine Rolex would be interested in knowing if/when/how many fake watch sellers had online shops that used the keyword 'rolex' in their domain as means of appearing reputable or signalling that they offer exclusive/luxury (knock-off) products. I believe they offer more services than that though, but the point is that they're not a regular registrar.
- C1D 13y ago
  I was surprised to see melbourneIT up there since I live in the same city they're based in. I'm wondering why an American company is using an Australian registrar, can anyone enlighten me?
ateevchopra 13y ago
No standard procedure ? Someone really gonna get fired ! "Hacking like its 1964" - Loved it
keidian 13y ago
Bit of trivia I didn't see noted: Web.com is the parent company of both NetSol and Register.com
deleted 13y ago
[deleted]
gnu8 13y ago
Nice, show 'em how it's done!

60 points by robk 13y ago

What, no phone call to verify the changes with the account holder on file? I would have hoped that was standard procedure...

mischanix 13y ago
Phone verification may have been performed using a phone number listed on the fake fax, if at all.
- cosmie 13y ago
  That was precisely my point, and why I'm so confused. You do not verify change requests with the change request, you verify it with details from the system of record. A classic example of this would be submitting a change of address to USPS or modifying an email address on an account. You don't verify that change with the new information, but rather by sending notification or confirmation to the previous address/email. The fact that a registrar wouldn't enforce such a process is... upsetting.
  - bradleyland 13y ago
    Preface: Ah, the smell of contempt in the morning! This post turned out to be pretty contemptible/cynical, but domain registration & management is a bit of a peeve of mine. I used to run an "IT consulting" company, and have thus developed the requisite jaded viewpoint from dealing with all of those customers who don't understand/value the responsibility of domain ownership. Every day, registrars are inundated with calls from incompetent domain owners who haven't kept their domain information up to date, and have lost control of their domain in some way or another. The registrars provide a process to recover your domain name, but that process relies heavily on human judgement. I think most programmers/technologists would be horrified at just how easily the process can be gamed. I've recovered no less than 5 domain names for friends/customers over the years, and I'm always shocked at how easy it is. If you can produce believable looking letterhead, and have done at least some cursory information gathering on the company in question, you can usually game the system. The reason this giant hole exists is because of customer service incentives. A large number of domain owners aren't responsible technology people. They're mom & pops, or some middle-manager who kind-of-sort-of understands the internet. They're people wearing many hats, and have never used a program like 1Password or LastPass to keep track of their important information. To add insult to injury, these same people are bombarded with fake domain renewal letters that result in their domain being hijacked by some shady business. The registrars end up handling the backside clean up for all of these incompetencies, and customers demand it. If a domain registrar began requiring the kind of verification that we'd expect, many people would simply lose their domain names and never do business with said registrar again. The registrars know this, so they make it (too) easy to recover a domain. IMO, there are two solutions: A regulatory body steps up and says: Domain owners are responsible for keeping your domain information and security credentials current. If you lose them, you will have to successfully navigate a lengthy and expensive verification process. The process will be standardized across the industry, and non-compliance will result in heft fines for the registrar. Alternatively, the option is given to domain registrants to treat their registration with a higher level of scrutiny. A kind of "I take responsibility" flag for your domain that significantly raises the bar for recovering the domain should you lose control of it. Neither of these will happen, because there is not enough incentive. The majority of domain owners will never be targeted in the manner illustrated here, so the service is unimportant to us. There aren't enough large companies to justify offering secure domain registration as a service. The rest of the world needs the easy recovery process because they're not competent/responsible enough to maintain control of their domain name.

ChuckMcM 13y ago

Remarkably powerful tool the FAX machine, to many bureaucracies have them connected directly into the brain.

ebilgenius 13y ago

Why are all these hackers pro-palestine?

cma 13y ago
If they were sampled evenly from world population, it would be what you would expect.
- corin_ 13y ago
  Agreed, but that sample wouldn't get many people who shout out their opinion without being asked by it (a majority may support Palestine, but far less actively make their voices heard about it, on either side)
BWStearns 13y ago
Judging by the report it seems that these hackers ARE palestinian. One could easily conclude that Palestinians are likely to be sympathetic to the Palestinian cause.
meowface 13y ago
There are a lot of "hacktivist" groups based in Palestine, Iran, Egypt, and Syria.

michaelt 13y ago

Made me wonder what registrar major internet companies use. Fortunately, whois can tell us: facebook.com -> markmonitor google.com -> markmonitor amazon.com -> markmonitor youtube.com -> markmonitor yahoo.com -> markmonitor baidu.com -> markmonitor wikipedia.org -> markmonitor linkedin.com -> markmonitor ebay.com -> markmonitor bing.com -> markmonitor microsoft.com -> markmonitor paypal.com -> markmonitor flickr.com -> markmonitor blogger.com -> markmonitor wordpress.com -> markmonitor live.com -> corporatedomains twitter.com -> corporatedomains apple.com -> corporatedomains cnn.com -> corporatedomains theguardian.com -> tucows TinyURL.com -> tucows theguardian.com -> tucows huffingtonpost.com -> melbourneit t.co -> melbourneit bitly.com -> godaddy barackobama.com -> godaddy dell.com -> safenames reddit.com -> gandi imgur.com -> enom ycombinator.com -> easydns craigslist.org -> netsol I don't know whether markmonitor deliberately try to get popular websites as clients, aiming for some sort of halo effect.

dmix 13y ago
melbourneit recently famous from the Syrian Electronic Army social engineering "hack" bringing down or defacing multiple sites including the NYTimes.com, where it is hosted. http://www.pcmag.com/article2/0,2817,2423699,00.asp http://www.pcmag.com/article2/0,2817,2423699,00.asp
pallandt 13y ago
MarkMonitor is used by companies that are interested in protecting their brand(s) online. For example, imagine Rolex would be interested in knowing if/when/how many fake watch sellers had online shops that used the keyword 'rolex' in their domain as means of appearing reputable or signalling that they offer exclusive/luxury (knock-off) products. I believe they offer more services than that though, but the point is that they're not a regular registrar.
C1D 13y ago
I was surprised to see melbourneIT up there since I live in the same city they're based in. I'm wondering why an American company is using an Australian registrar, can anyone enlighten me?

ateevchopra 13y ago

No standard procedure ? Someone really gonna get fired ! "Hacking like its 1964" - Loved it

keidian 13y ago

Bit of trivia I didn't see noted: Web.com is the parent company of both NetSol and Register.com

deleted 13y ago

[deleted]

gnu8 13y ago

Nice, show 'em how it's done!