Metasploit website hijacked via fax

http://grahamcluley.com/2013/10/metasploit-website-hijacked-pro-palestinian-hackers/

by robk • 13 years ago

60 21 13 years ago

cosmie2• 13 years ago

What, no phone call to verify the changes with the account holder on file? I would have hoped that was standard procedure...

mischanix• 13 years ago

Phone verification may have been performed using a phone number listed on the fake fax, if at all.

cosmie2• 13 years ago

That was precisely my point, and why I'm so confused. You do not verify change requests with the change request, you verify it with details from the system of record.

A classic example of this would be submitting a change of address to USPS or modifying an email address on an account. You don't verify that change with the new information, but rather by sending notification or confirmation to the previous address/email. The fact that a registrar wouldn't enforce such a process is... upsetting.

ChuckMcM• 13 years ago

Remarkably powerful tool the FAX machine, to many bureaucracies have them connected directly into the brain.

ebilgenius• 13 years ago

Why are all these hackers pro-palestine?

cma• 13 years ago

If they were sampled evenly from world population, it would be what you would expect.

corin_• 13 years ago

Agreed, but that sample wouldn't get many people who shout out their opinion without being asked by it (a majority may support Palestine, but far less actively make their voices heard about it, on either side)

BWStearns• 13 years ago

Judging by the report it seems that these hackers ARE palestinian. One could easily conclude that Palestinians are likely to be sympathetic to the Palestinian cause.

meowface• 13 years ago

There are a lot of "hacktivist" groups based in Palestine, Iran, Egypt, and Syria.

michaelt• 13 years ago

Made me wonder what registrar major internet companies use. Fortunately, whois can tell us:

  facebook.com -> markmonitor
  google.com -> markmonitor
  amazon.com -> markmonitor
  youtube.com -> markmonitor
  yahoo.com -> markmonitor
  baidu.com -> markmonitor
  wikipedia.org -> markmonitor
  linkedin.com -> markmonitor
  ebay.com -> markmonitor
  bing.com -> markmonitor
  microsoft.com -> markmonitor
  paypal.com -> markmonitor
  flickr.com -> markmonitor
  blogger.com -> markmonitor
  wordpress.com -> markmonitor
  live.com -> corporatedomains
  twitter.com -> corporatedomains
  apple.com -> corporatedomains
  cnn.com -> corporatedomains
  theguardian.com -> tucows
  TinyURL.com -> tucows
  theguardian.com -> tucows
  huffingtonpost.com -> melbourneit
  t.co -> melbourneit
  bitly.com -> godaddy
  barackobama.com -> godaddy
  dell.com -> safenames
  reddit.com -> gandi
  imgur.com -> enom
  ycombinator.com -> easydns
  craigslist.org -> netsol

I don't know whether markmonitor deliberately try to get popular websites as clients, aiming for some sort of halo effect.

dmix• 13 years ago

melbourneit recently famous from the Syrian Electronic Army social engineering "hack" bringing down or defacing multiple sites including the NYTimes.com, where it is hosted.

http://www.pcmag.com/article2/0,2817,2423699,00.asp

pallandt3• 13 years ago

MarkMonitor is used by companies that are interested in protecting their brand(s) online. For example, imagine Rolex would be interested in knowing if/when/how many fake watch sellers had online shops that used the keyword 'rolex' in their domain as means of appearing reputable or signalling that they offer exclusive/luxury (knock-off) products. I believe they offer more services than that though, but the point is that they're not a regular registrar.

C1D• 13 years ago

I was surprised to see melbourneIT up there since I live in the same city they're based in. I'm wondering why an American company is using an Australian registrar, can anyone enlighten me?

pallandt3• 13 years ago

I was curious about that as well.

I checked their website and they offer both affiliate and reseller programs. My best guess is that it's actually a 3rd party that sold the domains, yet a whois lookup returns the name of the parent company/true registrar. From what I can remember, domains purchased through OpenSRS's white-label domain reseller program still reveal that Tucows is the registrar, regardless from what partner of theirs you bought it from.

Maybe someone with more knowledge can help out.

tekacs• 13 years ago

I'd be intrigued to know why despite the fact that microsoft.com and bing.com are with markmonitor (along with much/most of MSFT, IIRC), live.com is with corporatedomains.

ateevchopra• 13 years ago

No standard procedure ? Someone really gonna get fired !

"Hacking like its 1964" - Loved it

keidian• 13 years ago

Bit of trivia I didn't see noted: Web.com is the parent company of both NetSol and Register.com

gnu8• 13 years ago

Nice, show 'em how it's done!

Metasploit website hijacked via fax

Related Stories