Twitter, NYT Whois and DNS altered, Syrian Electronic Army takes responsibility

http://thenextweb.com/twitter/2013/08/27/twitters-whois-records-altered-syrian-electronic-army-takes-responsibility/

by jpadilla_ • 13 years ago

163 96 13 years ago

thenextweb.com

unreal37• 13 years ago

Whoa. Twitter, NYTimes, HuffPo... all had their DNS records hacked? This seems huge.

icpmacdo• 13 years ago

How difficult of a thing is this to pull off?

cheald• 13 years ago

If you can compromise a shared registrar, pretty trivial.

16s• 13 years ago

You'd have to have the ability to change DNS records for their domains. If you can point "whatever.com" to a NS that you control, it's game over until they take it back.

aet• 13 years ago

Twitter is up. I still can't get NYT - down for over a day? wow

dimitar• 13 years ago

Why hasn't the SEA changed the nameservers?

InclinedPlane5• 13 years ago

DNSSEC most likely.

fotcorn3• 13 years ago

Nameservers of nytimes.com and twimg.com are changed:

Name Server.......... ns27.boxsecured.com

Name Server.......... ns28.boxsecured.com

jeremycole• 13 years ago

twimg.com seems to be hijacked

ikawe• 13 years ago

A status update now that it's fixed.

http://status.twitter.com/post/59528478030/twitter-service-i....

Kind of dodgy that there was no status update until 1.5 hours after the issue surfaced.

bluetidepro• 13 years ago

As someone asked in the comments of the article asked (no response yet), I'm curious myself...

"twimg.com is a domain used by Twitter which is an widget company that is part of a network of sites, cookies, and other technologies used to track you, what you do and what you click on, as you go from site to site, surfing the Web. Does that not mean that SEA will be intercepting this data?"

fotcorn3• 13 years ago

The tweet button/widget is served by http://platform.twitter.com so this shouldn't be a problem as long as the twitter.com nameservers are unchanged.

emil10001• 13 years ago

Couldn't they do this with any of the sites that they modify? That's what I am sort of wondering about, sure you could redirect the homepage to something dumb, and make it really obvious that the site has been attacked. But, it seems like they could have similarly done a man-in-the-middle and sucked up tons of data silently, without throwing up any big red flags.

grumps• 13 years ago

How hard is this to do...

I ask because I find it harder to believe that they are responsible for this. Just like I don't trust the YouTube videos either. I would find it more likely that three letter agencies are involved as PR.

pseudometa2• 13 years ago

I don't buy it either. Seems fishy.

mpyne4• 13 years ago

Fishy enough that the SEA's own Twitter account is gloating about it?

pain_perdu• 13 years ago

DNS Records have been hijacked and point to Syrian Electronic Army

http://i.imgur.com/RwH0mpI.png

ninjazee124• 13 years ago

NYTimes seems to be down and Twitter is be loading all wrong because twimg.com is down. Whoa! This is some serious stuff.

mhurron• 13 years ago

http://xkcd.com/932/

Ya, not so much.

fotcorn3• 13 years ago

The twitter frontpage is completly broken for me. Static assets like css and javascript are served by twimg.com, which are now missing. If SEA has access to a server which can take the load of twimg.com, they can inject their Javascript and possible exploits to ALL twitter users...

bpicolo• 13 years ago

Seems fine now

signed0• 13 years ago

Woah! Has Verisign been hacked?

$ whois twitter.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information.

TWITTER.COM.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM

TWITTER.COM

And then:

$ whois verisign.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information.

VERISIGN.COM.MIGHT.SUCK.FYRAE.COM

VERISIGN.COM

I get really crazy responses like this for almost every major site I try (cnn.com, yahoo.com, google.com).

dobbsbob2• 13 years ago

I never use CA's so didn't notice this, I only use the twitter app which Moxie Marlinspike and Charlie Miller hardened with pinned certs to avoid all authorities

Also this: http://stackoverflow.com/questions/4415269/suspicious-result...

arn• 13 years ago

no.

VERISIGN.COM.MIGHT.SUCK.FYRAE.COM is a subdomain of FYRAE.com

See this: https://news.ycombinator.com/item?id=6204867

InclinedPlane5• 13 years ago

  whois twitter.com => whois(".*twitter\.com.*")

lampooned• 13 years ago

Facebook's whois result is pretty funny.

   $ whois facebook.com

   Whois Server Version 2.0

   Server Name: FACEBOOK.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
   IP Address: 69.41.185.229
   Registrar: TUCOWS DOMAINS INC.
   Whois Server: whois.tucows.com
   Referral URL: http://domainhelp.opensrs.net

dobbsbob2• 13 years ago

US is about to bomb Syrian military assets so this is Iran's response. The SEA is clearly Iranian. Email them something in Farsi or PM one of their propaganda accounts on youtube they usually answer.

last time I checked ns1.syrianelectronicarmy.com was hosted out of Russia and includes " qatar-leaks.com" which seems to have disappeared

15charusername• 13 years ago

Why Iran? Surely Russia is a bigger suspect, but right now, my biggest suspect would be the NSA/CIA, the timing of the Syrian escalation is just too perfect.

eshvk2• 13 years ago

Why is Russia a bigger suspect? A study of foreign policy and defence would appear to suggest that Iran perceives that it is under threat of invasion from America.

pseudometa2• 13 years ago

Dusting off my tin foil hat, I would go with Israel in collusion with the NSA/CIA. They have the most to gain by turning the media against Syria and the technical capabilities as proven with their involvement in stuxnet. http://en.wikipedia.org/wiki/Stuxnet

InclinedPlane5• 13 years ago

In the middle east Iran* probably has the greatest geopolitical reach of any country within the region. Through Hezbollah they have an enormous impact on Syria, Lebanon, the Palestinian territories and even Israel. If the al-Assad regime falls Iran has the most to lose as suddenly it would become far more difficult, logistically and otherwise, to provide support to its groups in the Levant.

This explains why Iran is threatening action if the US bombs Syria, for example.

The Putin regime has certainly shown itself capable of significant international "hijinx" (such as assassination, vote rigging, etc.) but overall this doesn't fit their MO.

(*: note that when I say "Iran" here I am talking about the current Iranian regime, very much not the Iranian people.)

mjolk2• 13 years ago

Why do you suspect this is sanctioned by Russia? What would they have to gain from pestering a couple media companies, especially at the risk of losing their business? What is your logic here?

InclinedPlane5• 13 years ago

Last update on status.twitter.com was August 6th.

Get your shit together guys, this is serious business.

Edit: looks like there's an update now: http://status.twitter.com/post/59528478030/twitter-service-i...

flaktrak• 13 years ago

this is about all the Syrian govt can retaliate with. it's not like they can physically reach and stop the USA from attacking them.

Questionoor• 13 years ago

SEA has a history of doing much more than attempting to offset perceived propaganda[1]. With in that site is dozens of gigabytes of logs from Bluecoat[2] proxy hardware that sat in datacenters for Syrian ISPs.

A good amount of what is contained in the logs is things like porn searches, more porn, porn. But amongst the typical naughty bits things like religious queries for Christians, Catholics, Jews, Muslims were being recorded.

Telecomix[3] helped to leak the log-set, and as it stands it is _the_ example of how state entities monitor peoples of 'interest.' Much of these people are long since dead, killed early on as they were the most public[4].

So while the SEA's most public facing events are hijacks, phising, and massive redirects. Please do focus on the end result of pervasive surveillance[5].

[1] http://bluesmote.com/

[2] http://www.bluecoat.com/

[3] http://en.wikipedia.org/wiki/Telecomix

[4] http://en.wikipedia.org/wiki/Ibrahim_Qashoush

[5] http://imgur.com/gallery/qz7wm

ballard• 13 years ago

Makes you wonder whom has access to Palantir.

jval2• 13 years ago

Ok, firstly whois Microsoft.com just returns all URLs with Microsoft.com in them, even as a subdomain, so they haven't been hacked and that result has been there for ages. Same goes for Verisign etc.

TechCrunch is reporting that registrar MelbourneIT has been hacked.. This wouldn't surprise me but I'm puzzled as to why either site would register with such a bad registrar.

joshfraser• 13 years ago

What do you mean? MelbourneIT are huge and generally have a pretty decent reputation.

devopstom2• 13 years ago

Had. Until now.

jbarham• 13 years ago

MelbourneIT are huge and generally have a pretty decent reputation.

Clearly you have never used their ticketing system.

jval2• 13 years ago

Yeah, you're right that was probably a bit harsh given that I'm just running from what I've heard from others, and the fact that last year they were still charging $150 for registration. But who am I to know - I don't want to be one of those token HN trolls who pays out on people for the sake of it so I retract my initial comment.

jacques_chester• 13 years ago

MelbourneIT have incumbency and good marketing. I've never been all that impressed with their prices or service.

WettowelReactor• 13 years ago

When we used to have MelbourneIT they sent us an email with our login password in it in a promotional email. When I inquired how they could possibly be properly securing my account when if they where storing my password in some recoverable fashion I got a form letter back stating they followed all the industry security practices. Needless to say I started the transfer of all our domains that same day.

Their exact response: "Our systems follow strict security measures and only enables us to send the password out to the main email contact in case of password recovery being requested. So rest assured your account password is safely stored with us. "

devopstom2• 13 years ago

I think the important question here is "Why on earth did they choose that registrar, for something so crucial?"

I bet they'll put in for a transfer ASAFP now!

seiji• 13 years ago

Corrections:

They aren't URLs, they are domain names.

The ones that aren't the domain name you are looking for are glue records.

There's no way to globally search "show me every corp.*.com domain in existence."

smackfu• 13 years ago

but I'm puzzled as to why either site would register with such a bad registrar.

Melbourne IT acquired part of Verisign a few years ago, their Enterprise "Digital Brand Management Services". I assume these big companies are either existing customers, or just new customers using that particular part of the service.

nfoz• 13 years ago

Don't trust anything you read here, folks...... too many that don't know anything about WHOIS or DNS.....

Helianthus2• 13 years ago

Now the truly paranoid are caught in the paradox of trusting you!

N0RMAN• 13 years ago

the traceroute for twimg.com end's in russia, I'm right? (141.105.64.37)

mehmehshoe• 13 years ago

Yup. The biggest fallout from this won't be that those big sites were down for hours, it will be the millions of computers that redirected to that IP.

http://blog.opendns.com/2013/08/27/high-profile-domains-unde...

Shank• 13 years ago

While they may have fixed twimg.com on the DNS level, changes are still taking forver to propogate back out. Right now I'm still getting no data from it.

To add to the matter, SEA is certainly aware of this:

"So, do we host http://twimg.com with Javascript code so all Twitter users will be redirect to our website? #SEA"

https://twitter.com/Official_SEA16/status/372496956020379648

cpursley• 13 years ago

"We are protecting you from the hacker-terrorists"

Is this not obvious to everyone else as it is to me? People, think about what is happening here and the timing of it all.

This is a false flag operation to turn the public opinion against "hackers" so these crazy internet regulations bills can start passing and so that they can get away with spying scandal.

If these "hackers" taking down social media sites and NYT times were actually the Syrian government, they'd be going after US government targets in an effort to undermine the bombing that's about to begin.

Their regime is about to get bombed. Taking down twitter is low on their priority list. But it's quite good timing for a propaganda campaign against "hackers" and now allows the US government to label hackers as terrorists. Scary stuff.

jacquesm2• 13 years ago

This is a false flag operation to turn the public opinion against "hackers" so these crazy internet regulations bills can start passing and so that they can get away with spying scandal.

You can't know for sure it is a false flag operation, but you can't easily rule it out either.

mpyne4• 13 years ago

It sounds like a religion to me, then.

krelian2• 13 years ago

If you think they are so sophisticated to create this false flag operation why are the targets and magnitude of this so lame?

jnbiche2• 13 years ago

NYTimes and Twitter are lame targets? In the US, at least, you don't get a much higher profile non-government target than the NY Times. I mean, if this were a false flag operation -- and I'm not convinced it is -- then the three-letter guys wouldn't very likely chose to target themselves, or other government, would they? They would portray them as being inept at defending themselves.

eli2• 13 years ago

See this is why it's a great conspiracy theory. Parts of the attack that are well executed are used as proof that the powerful US Gov't is behind it. Parts that are poorly executed are obviously put there on purpose and thus also proof that the powerful US Gov't is behind it.

eshvk2• 13 years ago

Their regime is about to get bombed. Taking down twitter is low on their priority list. But it's quite good timing for a propaganda campaign against "hackers" and now allows the US government to label hackers as terrorists. Scary stuff.

Yes, because the bombing of the regime means that every single person supporting the Syrians is automatically going to focus all their efforts on one single task. It is not like there can be people with different perspectives on how to solve a "problem" with the same common goal. /s

mcintyre1994• 13 years ago

This is especially true when you look at how fractured and ill-defined "person supporting the Syrians" is.

rtpg• 13 years ago

Have we heard any government officials calling for any drastic attack on your civil liberties yet?

If you think people can't make the difference between the SEA and people who browse reddit and privacy activists, then you're setting the bar pretty low for the intelligence of the population. Especially considering people are getting more and more informed

Your need for a conspiracy seems pretty great

lettergram• 13 years ago

I disagree with the conspiracy idea, but from what I've seen the bar should be pretty low for the intelligence of the population (at least in this area). Most of the people I know ignore pretty much everything that has been going on with snowden and as for the SEA, they would probably thing it was part of the Syrian government.

Mongoose• 13 years ago

Is the redirect loop affecting your personal website the government's fault too?

anigbrowl2• 13 years ago

Is this not obvious to everyone else as it is to me?

Another possibility is that your opinion is wrong.

If these "hackers" taking down social media sites and NYT times were actually the Syrian government

The thing is, nobody thinks the SEA is part of the Syrian government, any more than the Irish Republican Army was part of the Irish government. It's just a name the group have adopted to show their affiliation and make themselves feel badass.

ryalfalpha2• 13 years ago

I don't get your comment?... prominent members from various versions of the IRA are and have been members of Irish governments, see Gerry Adams/Martin McGuinness (Or even Michael Collins if you're talking way back).

shard9722• 13 years ago

Another possibility is that your opinion is wrong.

Another possibility is that your opinion is wrong.

chrischen• 13 years ago

It just means we need our own hackers.

mpchlets2• 13 years ago

So not sure what to say, but this is the email I received from DynEct the other day: subject: Webinar Wednesday: Are You Prepared For DNS Disaster? sender: Dyn hello@dyn.com via dynect-mailer.net

and some info from my old whois: $ whois twitter.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information.

   Server Name: TWITTER.COM.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM
   IP Address: 209.126.190.71
   Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
   Whois Server: whois.PublicDomainRegistry.com
   Referral URL: http://www.PublicDomainRegistry.com

   Domain Name: TWITTER.COM
   Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
   Whois Server: whois.melbourneit.com
   Referral URL: http://www.melbourneit.com
   Name Server: NS1.P34.DYNECT.NET
   Name Server: NS2.P34.DYNECT.NET
   Name Server: NS3.P34.DYNECT.NET
   Name Server: NS4.P34.DYNECT.NET

mpchlets2• 13 years ago

Seems to me that melbourneit.com was the cause of these problems - that is the related link between all these different problems - basically poisoning the DNS of any popular company that uses them.

fudyy2• 13 years ago

Sorry to be cynical and bring politics into this, but I hope that U.S. liberals respond the way they did to Bush to Obama with this strike.

Comedians, the media, etc. accused Bush of an adjust war for someone that used a chemical attack on his own people because there were no found WMD's even though there was evidence of a chemical attack.

Now we are going in again to try to save things. Will Obama come out as a hero? Probably. Should he? Well if he should, Bush needs to get some slack finally.

Don't get me wrong- I think we should do something. But when I hear we are going to do another 3 day bombing run, it's just like Iraq all over again, except this time it's who the Democrats want to bomb. Isn't there an answer that doesn't involve bombing? What are we, Germany in WWII?

Niten• 13 years ago

That comparison is quite the stretch, though.

The currently debated reaction to Syria's chemical weapons attack is a limited response intended to punish the Assad regime, to attempt to reduce its ability to launch more such attacks in the future and to provide it with a disincentive to do so.

It would not be an attempt to topple the regime or to take over Syria for American interests.

Further, the use of chemical weapons in the Iran-Iraq war as a pretext for invading Iraq in 2004 is, as we all know, extremely disingenuous, given that these attacks happened more than a decade prior – and with the support of the U.S. at the time:

http://america.aljazeera.com/articles/2013/8/26/new-document...

[EDIT: I'm not arguing in favor of the U.S. intervening in Syria, though, least of all without proper congressional authorization.]

InclinedPlane5• 13 years ago

I think the core problem is that military adventurism in this region shouldn't be predicated solely on, say, chemical weapons. Realistically chemical weapons don't tip the balance scales very much in the realm of America's narrow/selfish geopolitical interests, in the interests of humaneness, or in the more broad interests of attempting to do whatever is best for the people of the region on a long-term basis (specifically in regards to peaceful co-existence and consensual governance).

We've attempted low touch "tomahawk diplomacy" before. We bombed Saddam's Iraq for their intransigence and aggression in the late '90s, we bombed Afghanistan and the Suddan in 1998 in retaliation for the bombings of our embassies, and so on. For the most part such things are utter wastes of effort.

Retaliatory strikes are almost always bullshit. "Proportionate response" is just a fancy word for retaliation or revenge. Low touch warfare is almost always a mistake (see also: drone campaigns). We need to have clear geopolitical objectives, we need to be even clearer how we plan to achieve those objectives, and we need to follow through with as much effort (in whatever form) is required to achieve those objectives. Anything else is like some sort of macabre lottery. Attempting to see if killing a few people will magically result in a desired outcome even though the chances are low.

Granted, one should be under no illusions, there are some very serious "bad guys" in the region, and in Syria specifically. Bad guys who few people on Earth should object to being killed. However, the situation is also much more complex than that and it's never the case that military action only kills or injures the exact people you want and no one else. There is a 3 (ish) side sectarian war in progress in Syria which has now spread to Lebanon. Taking out the al-Assad regime could perhaps be a good thing but it won't bring an end to the sectarian war. Whether or not chemical weapons are used as long as that war continues tens of thousands of people are going to be killed each year it goes on, if not more. I don't think the Obama administration has a very strong understanding of the complex dynamics on the ground in Syria nor do they have a firm plan on how to end the war there. Moreover, I think the lessons the administration has taken from what happened in Libya (even taking into account the later attack on the US embassy) are likely to lead them to believe that the situation is far less complex than it actually is.

unhammer• 13 years ago

Is this what DNSSEC is supposed to protect you from? (Or could they just change your dnssec records as well?)

Twitter, NYT Whois and DNS altered, Syrian Electronic Army takes responsibility

Related Stories