31–40 of 92 posts
Considering that most of the big sites run local variants of their services using these TLDs is it fair to assume that one of these next ones could be of the phishing kind? What's the best thing to do - always use the .com hoping that it is safer?
Earlier quoted context omitted.
I think saying "google.ps was hacked" is a perfectly reasonable way to describe what happened.
I don't agree at all, the system which was hacked is not in Google's control at all, even though it does depend on it for DNS SOA. Every site depends on root DNS servers to do their job right...the root for .ps was hacked...that's what happened here...google was affected, but not hacked.
The SOA record is almost irrelevant in this case, unless you are seeing some trickery where they set high TTLs or something to keep the "hack" around longer after it has been corrected.
There is only one root (which is kinda what makes it a root) - and in this case the root servers are doing their job just fine. DNS is hardly even involved. As far as I can tell this was simply a compromise of the web UI that allows for the management of domains under the .ps ccTLD. Probably just another sloppy front end developer.
google.ps has not been hacked. The .ps registry was. Google DNS servers have been changed to omar.genious.net and hamza.genious.net
Hacking a registry is even more alarming.
Oh man, imagine the heart attack the engineer who first got this ticket must have had before he realized it was a just a dns hijacking.
Earlier quoted context omitted.
I don't agree at all, the system which was hacked is not in Google's control at all, even though it does depend on it for DNS SOA. Every site depends on root DNS servers to do their job right...the root for .ps was hacked...that's what happened here...google was affected, but not hacked.
You are using these words, but I don't think you know what they mean. The SOA record is almost irrelevant in this case, unless you are seeing some trickery where they set high TTLs or something to keep the "hack" around longer after it has been corrected. There is only one root (which is kinda what makes it a root) - and in this case the root servers are doing their job just fine. DNS is hardly even involved. As far…
Aren't we seeing a lot of DNS based attacks in the recent past? I remember .pk TLD was hacked not too long ago. Considering that most of the big sites run local variants of their services using these TLDs is it fair to assume that one of these next ones could be of the phishing kind? What's the best thing to do - always use the .com hoping that it is safer?
ICANN needs to mandate stronger requirements for best practices with web based management UIs. Unfortunately they have little in the way of real control over ccTLDs.
You'd be best served registering ccTLDs and redirecting them to your gTLD of choice (say, .com) and not trying to serve localized content from them.
Aren't we seeing a lot of DNS based attacks in the recent past? I remember .pk TLD was hacked not too long ago. Considering that most of the big sites run local variants of their services using these TLDs is it fair to assume that one of these next ones could be of the phishing kind? What's the best thing to do - always use the .com hoping that it is safer?
This isn't a DNS issue, it's a SQL injection attack. ICANN needs to mandate stronger requirements for best practices with web based management UIs. Unfortunately they have little in the way of real control over ccTLDs. You'd be best served registering ccTLDs and redirecting them to your gTLD of choice (say, .com) and not trying to serve localized content from them.
Fair warning, that link goes to the compromised site.