Twitter outage via DNS hijacking

Published: 2009-12-18. Last Updated: 2009-12-18 08:37:38 UTC
by Stephen Hall (Version: 1)
5 comment(s)

A number of diary readers have submitted that the popular micro blogging site, Twitter.com has been defaced this morning.

The twitter.com status page has the following report:

Update (11:28p): Twitter’s DNS records were temporarily compromised but have now been fixed. We are looking into the underlying cause and will update with more information soon.

If we receive any more information concerning the outage, or how the hijacking occured, we shall update the diary during the day. If you have any additional information, please let us know via the contact form.

Update: The following screen grab shows the DNS hijacking as recorded via the PassiveDNS systems. The host www . mowjcamp . org is currently hosting the defacement.

Steve Hall

 

Keywords: twitter
5 comment(s)

Comments

Here's an image courtesy of the folks at hackitall, although I'm quite certain it will be everywhere across the news by the morning. "Iranian Cyber Army" claiming responsibility in very broken English.

http://i.imgur.com/Q1EgM.jpg

Tisiphone

Dec 18th 2009
1 decade ago

Just updated the diary to show what the results of the dns hijacking where.

Stephen

Dec 18th 2009
1 decade ago

What are the result of all this. Should I assume that the defacer now has my user credentials ? Or was it only the frontpage that was defaced ?

The IT security professional part of me screams "change password change password"

povlhp

Dec 18th 2009
1 decade ago

povlhp - neither, although you should always change your password ;) The DNS entries for twitter were changed to point at another site (mowjcamp) which hosted the defacement.

Stephen

Dec 18th 2009
1 decade ago

I've collected all the information which I could find "out there" in a blogpost: http://hype-free.blogspot.com/2009/12/twitter-hacked.html

One interesting thought experiment to perform is the following: what if the rogoue server would have responded to the TwitterAPI requests (especially the authentication requests)? How many people would have said to their twitter client: ignore the certificate error?

Cd-MaN

Dec 18th 2009
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives