Hackers hijack critical Internet organization sites

ROOTKIT : Hackers hijack critical Internet organization sites

Gregg Keizer

Computerworld

June 27, 2008

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9104298&source=NLT_SEC&nlid=38

Turkish hackers yesterday defaced the official sites of the international organizations that oversee the Internet's critical routing infrastructure and regulate domain names, researchers said today.

A group calling itself "NetDevilz" claimed responsibility for the hack, which Thursday morning temporarily redirected visitors to the sites for IANA (Internet Assigned Numbers Authority) and ICANN (Internet Corporation for Assigned Names and Numbers).

Users who tried to reach iana.com, iana-servers.com, icann.com and icann.net were shunted to an illegitimate site, said researchers at zone-h.org, a group that collects evidence of site attacks, including page defacements and redirects. According to a screen capture of the defacement snapped by zone-h.org, the bogus site simply displayed a taunting message: "You think that you control the domains but you don't! Everybody knows wrong. We control the domains including ICANN! Don't you believe us?"

IANA, ironically, is the organization responsible for managing the DNS root zone and assigning the DNS operators for the Internet's top-level domains, such as .com and .org. DNS, which translates the domains and URLs -- such as computerworld.com -- into IP addresses, is a critical component of the Web's traffic-guiding infrastructure.

ICANN, which oversees IANA, also allocates IP address space and manages the Web's top-level domain naming system.

Perhaps not coincidental to the defacement, ICANN was in the news yesterday for voting to relax the rules in assigning and managing generic top-level domains.

The hackers redirected IANA and ICANN traffic to the same IP address that they used last week when they broke into Photobucket Inc.'s image-sharing site and pushed its users to a server operated by Atspace.com, a German hosting service, said Bulgarian security researcher Dancho Danchev in a blog post today.

A spokesman for ICANN contacted Friday morning wasn't aware of the hack, and declined comment until he found find out more.