DNS Servers of 3 Dutch Hosting Firms Hijacked, Thousands of Sites Serve Malware

snoopy · Aug 7, 2013

DNS Servers of 3 Dutch Hosting Firms Hijacked, Thousands of Sites Serve Malware

On Monday, we reported that hundreds of websites – including the popular online electronics shop Conrad.nl – were redirecting their visitors to malware after the DNS servers of Dutch web hosting company Webstekker were somehow hijacked.
Researchers from security firm Fox-IT have analyzed the attack and determined that a total of three web hosts have been impacted.
Web hosting companies Digitalus and Virtual Dynamix (VDX) have also had their DNS servers compromised. All the websites that use the DNS servers of these organizations have been configured to serve malware.

In a statement published on Monday, Digitalus representatives said the attackers modified the domain registration systems from SIDN, the Foundation for Internet Domain Registration in the Netherlands, with external name servers.

VDX has also noted that its own name servers have not suffered any changes and blamed the incident on SIDN. The company is working with SIDN on trying to determine what happened.

For the time being, it’s uncertain how the attackers managed to gain access to SIDN’s domain registration systems.

Webstekker has also published a brief statement. The company hasn't provided many explanations. Instead, it has denied reports that its DNS servers redirected website visitors to malware.

As far as the malware is concerned, Fox-IT has published an analysis of the attack.
Click to expand...

More on this topic here: http://news.softpedia.com/news/DNS-...Thousands-of-Sites-Serve-Malware-373308.shtml

Log in or Sign up

DNS Servers of 3 Dutch Hosting Firms Hijacked, Thousands of Sites Serve Malware

snoopy Registered Members

Share This Page

Log in or Sign up

DNS Servers of 3 Dutch Hosting Firms Hijacked, Thousands of Sites Serve Malware

snoopy Registered Members

Share This Page

Useful Searches