Turkish hackers strike websites with DNS hack

Websites belonging to major companies were redirected to a defacement page via DNS record tampering

A Turkish hacking group managed to tamper with Internet addressing records over the weekend, redirecting dozens of websites belonging to companies including Microsoft, UPS and Vodafone to a different web pages controlled by the hackers.

According to Zone-H, a website that tracks defacements, 186 websites were redirected to a page controlled by "Turkguvenligi." A message on the redirect page read: "4 Sept. We Turkguvenligi declare this day as World Hack­ers Day - Have fun ;) h4ck y0u."

All of the websites were registered through NetNames, which is part of NBT group. NetNames provides DNS (Domain Name System) services for the websites, which is the system used to translates a domain name into an IP address that can be called into a web browser.

Turkguvenligi managed to hack NetName's DNS servers through a SQL injection attack, which involves putting commands into a web-based form to see if the back-end database responds. If those commands aren't scanned for malicious code, an attacker could gain access to the system.

In the case of NetNames, Turkguvenligi put a redelegation order into the company's system and changed the address of the master DNS servers that served data for the websites, according to a statement from NetNames. The attack occurred around 9 p.m. BST on Sunday.

"The rogue name server then served incorrect DNS data to redirect legitimate web traffic intended for customer web sites through to a hacker holding page branded Turkguvenligi," the statement read. "The illegal changes were reversed quickly to bring service back to the customers impacted and the accounts concerned have been disabled to block any further access to the systems."

The hack accomplished by Turkguvenligi is a powerful one. Although it appears the goal of the group was just to vandalize the sites for a while, the group could have set up lookalike sites for the real ones, tricking users into thinking they were on the legitimate site and possibly stealing logins and passwords.

Two of HSBC's banking sites -- one with a country-code Top Level Domain in South Korea and one in Canada -- were targeted, according to the list compiled by Zone-H.

Other websites affected were those belonging to The Telegraph newspaper, The Register technology news site, Coca-Cola, Interpol, Adobe, Dell, several Microsoft country sites, Peugeot, Harvard University and the security companies F-Secure, BitDefender and Secunia. The website for Gary McKinnon, the so-called NASA hacker who is appealing extradition to the U.S. on hacking charges, was also hit.

The Register wrote that its website was not breached and that service was restored about three hours after the attack.

"As far as we can tell there was no attempt to penetrate our systems," wrote Drew Cullen . "But we shut down access/services - in other words, anything that requires a password - as a precaution."

DNSSEC, a security measure now being deployed by many registrars to guard against DNS tampering may not have prevented this kind of attack, said Paul Mutton , a security analyst with Netcraft.

DNSSEC uses public key cryptography to digitally "sign" the DNS records for websites. It is designed to stop attacks such as cache poisoning, where a DNS server is hacked, making it possible for a user to type in the correct website name but be directed to a fake website.

"If the attacker was able to change the DNS settings held by the domain registrar, presumably they could also have changed other settings, such as disabling DNSSEC, or rather, simply change the DNS settings to point to nameservers that do not support DNSSEC."

NetNames described the attacks against its systems as being "sustained and concentrated." "We will continue to review our systems to ensure that we provide our customers a solid, robust and above all secure service," it said.

Send news tips and comments to jeremy_kirk@idg.com

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusionsecuritydata breachdata protectionNetNames UK

More about Adobe SystemsASABitDefenderBT AustralasiaDellDell ComputerF-SecureHarvard UniversityHSBCInterpolMicrosoftNASANetcraftPeugeotSECSecuniaVodafone

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts