The website of a Syrian telecommunications provider redirected to AT&T’s website and then T-Mobile’s on Wednesday, an apparent prank by a hacker who has been probing the country’s Internet infrastructure for several days.
The hacker apparently found a way to modify the authoritative DNS (Domain Name System) record for the Syrian Telecommunications Establishment (STE), said Doug Madory, senior analyst with Renesys, a company that monitors global Internet activity.
The style of hack is similar to one that affected The New York Times, Twitter, Sharethis and others on Tuesday when certain domain names they controlled were pointed to an IP address controlled by the Syrian Electronic Army (SEA), a group of pro-Syrian government cyber-attackers.
DNS is a distributed database that translates domain names, such as twitter.com, into an IP address that can be called up in a browser.
The DNS server used by STE also runs several other Web services “which is quite unusual for high-profile DNS servers,” said Andree Toonk, founder of the network monitoring company, BGPmon.net.
“It’s not unlikely the attacker gained access to this machine exploiting one of these services,” Toonk said.
The attack on STE also modified the organization’s mail exchange (MX) records, which are used to route email messages.
At one point, STE’s MX record pointed to a domain in Israel. The record was then changed to point to a mail server run by Iran’s presidential office, Madory said. Then the hacker changed it once more to “oliver.tucket.boom.”
On Wednesday, The Washington Post published an interview with a person going by the pseudonym “Oliver Tucket,” who took credit for a series of attacks on the Syrian’s government’s infrastructure.
The Post identified him as an American white-collar worker who has sought to embarrass President Bashar al-Assad’s regime. A Twitter account, @olivertuckedout, showed several tweets on Sunday claiming attacks against Syria. The person running that Twitter account could not immediately be reached.
It’s unlikely that the MX record tampering actually allowed the hacker to intercept emails, although that in theory is possible. Emails directed to another server that is not configured correctly to receive mail would be rejected, Madory said.
The MX record tampering is likely designed “more just to embarrass,” Madory said.
Syria’s government has waged a long-running, bloody campaign against rebels seeking to topple al-Assad’s government. In protest of coverage of the conflict, the SEA has conducted a range of cyberattacks against the websites and Twitter accounts of media outlets such as the Financial Times, the Associated Press, The Guardian, BBC and Al Jazeera.
The SEA’s attack on Tuesday compromised a reseller of domain name services affiliated with Australia-based Melbourne IT.
Through a spear phishing email, the group gained account credentials that allowed it to modify authoritative DNS records for many websites, redirecting people to a website in Russia that it controlled.
Related Articles
