DNS

Anatomy of a DNS Hack


Screenshot of Hack SiteThis weekend, the DNS settings of a group of popular websites were hacked to redirect to the site of a Turkish hacker.

When users attempted to visit the sites of The Daily Telegraph, UPS, Vodaphone, The Register, National Geographic and others, they were greeted by a headline reading "Turkish Security, Come to Papa" in Turkish (see picture, left). The group behind the hack also claims credit for hacking the South Korean domain name registrar last month, an attack that affected over 100,000 domains, including those of HSBC Korea and Epson Korea.

When a site's DNS settings are hacked, it is not the same as the website itself being hacked. When hackers go after a website, they look for vulnerabilities in the site's code. When they target the DNS settings, they have to hack into the domain name registrar in order to gain access. Representatives from The Guardian reported that the hackers had gotten access through NetNames and others; CNET confirmed this yesterday.

The DNS settings of a given domain name basically tells it what IP address it should direct to; in this case, the hackers changed the IP addresses listed to the one for the "Turkish Security" site. Because of the way DNS changes work, not all visitors to these sites were affected by the hack at the same time. In turn, not all will be able to see the fixes that are made at the same time. As a precaution, The Register has opted to shut down its entire site as a precaution to shield its readers. Users can also clear their cookies in order to block the hackers from stealing their information.

Fortunately, this hack appears to merely be a prank. But the potential damages that DNS hacks are capable of wreaking are no joke.

More Than Just Words – ICANN Comment Periods, Paper Tigers, and How to Achieve Results


Since we cofounded the Coalition Against Domain Name Abuse (CADNA) in 2007, the non-profit has been dedicated to both building awareness and taking active steps to prevent cybersquatting and other online infringements. One of the main avenues for achieving these goals has been to engage with the Internet Corporation for Assigned Names and Numbers (ICANN), the international regulatory body that coordinates the Domain Name System at the top level. Initially, CADNA focused its efforts on trying to affect change in ICANN within the framework it had established, namely by submitting comments on as many issues as we could to try to get our message, the message of brand owners and consumers, heard.

Eventually it became clear that relying on comments was simply not enough. ICANN is a captured regulator primarily beholden to the interests of a relatively small group that doesn’t represent the overall Internet community. As such, trying to seriously alter the policy development process of ICANN through written comments that were ultimately ignored was not a practical way to make real progress. This is not to say that CADNA has ceased participating in ICANN’s public comment periods. On the contrary, CADNA has continued to submit comments to make its members’ opinions known, and also to prove that it is still willing to engage with ICANN. And there is some evidence that the efforts of CADNA and other comment submitters have made an impact: in some recent redlined drafts of initiatives under the new gTLD rollout, there have been references to changes made as a result of public comments. However, ICANN has a history of heeding the recommendations of only select groups when crafting these types of public-comment-driven changes in the past.
 
What happened with the Expression of Interest (EOI) program is a prime example of this. The idea behind the EOI process was to create a data-gathering model that would gauge if there was a demand among new and existing registry operators for new gTLDs. Though the EOI process was created to respond to Internet users questioning the need for new gTLDs, ICANN first put forth a flawed EOI model and then did not follow through to create a model that satisfied its constituents. Earlier this week, ICANN announced that in order to more quickly launch new gTLDs, it had cancelled the EOI program. Peter Dengate Thrush, ICANN's Board Chairman, said "we are now so close to launching the new gTLD process that we simply thought it better to move ahead as quickly as possible without adding the EOI element."
 
By doing this, ICANN has willfully decided to ignore its users' concerns in order to quickly rollout a program that will bring in millions of dollars for this "nonprofit".
 
It is not my intention to imply that stakeholders should stop participating in ICANN’s public comment periods or to insinuate that CADNA plans to do so; however, I do wish to point out the general ineffectiveness of public comments to encourage bigger action. In order to really make positive steps forward in improving ICANN and its policy development, CADNA has refocused its efforts on working with members of Congress on these issues and working more diligently toward developing legislation to help resolve the problems. Long term solutions to the Internet’s systemic problems that are within ICANN’s control are unlikely to emerge from within the ICANN community, but rather from the governments and its agencies who are ultimately responsible for defending the public interest.
 
I see other groups submitting comments, participating in ICANN and then simply waiting to see results. Now more than ever, as ICANN is developing plans to drastically alter the DNS and the shape of the Internet as a whole, it is crucial to move away from the paper – to move beyond simply providing comments – and take up bigger, more effective action. The incentives to achieve certain outcomes in the ICANN policy development process are too great for us to assume the outcomes are not predictable - paper tigers will not stop a chaotic introduction of new TLDs and they will not clean up WHOIS or stop all of the registrar abuse. Regulatory action needs to be both domestic and international and the time to act is now.