Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

.pk registrar hacked, Pakistani sites for Google, MSN, Apple, Ebay redirected

thehackersmedia.blogspot.ro

Post reply on HN
Print view View original

11–15 of 15 posts

Re: .pk registrar hacked, Pakistani sites for Google, MSN, Apple, Ebay redirected

#11

Post by irfan »

There are 975 .Pk domains registered by MarkMonitor. google, visa, PayPal, sony, zynga, microsoft, hp all rely on MarkMonitor for their identity in Pakistan. It seems that MarkMonitor's account with pknic was compromised. 110 .PK domains had their name servers changed to freehostia.com recently. All of them registered by MarkMonitor. Here is the list: http://i.com.pk/110-pk-domains-managed-by-markmmonitor-got-h... [note: this list was compiled by me]

Re: .pk registrar hacked, Pakistani sites for Google, MSN, Apple, Ebay redirected

#12

Post by jrockway »

codeka wrote: post #5

This is what I'm getting for google.com.pk currently: ;; ANSWER SECTION: google.com.pk. 3578 IN A 127.0.0.1 The name server seems to be set to some random one as well: ;; AUTHORITY SECTION: google.com.pk. 38400 IN NS dns1.freehostia.com. google.com.pk. 38400 IN NS dns2.freehostia.com. Google normally host their own DNS, so I'd expect that to go ns1.google.com (etc). Doing a whois for google.com.pk returns the address…

I also find it amusing that the bad DNS entry propagated to 8.8.8.8:

    $ dig @8.8.8.8 www.google.pk

    ; > DiG 9.8.4 > @8.8.8.8 www.google.pk
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER

Re: .pk registrar hacked, Pakistani sites for Google, MSN, Apple, Ebay redirected

#13

Post by sek »

irfan wrote: post #11

There are 975 .Pk domains registered by MarkMonitor. google, visa, PayPal, sony, zynga, microsoft, hp all rely on MarkMonitor for their identity in Pakistan. It seems that MarkMonitor's account with pknic was compromised. 110 .PK domains had their name servers changed to freehostia.com recently. All of them registered by MarkMonitor. Here is the list: http://i.com.pk/110-pk-domains-managed-by-markmmonitor-got-h... [n…

So basically they are the ones who got hacked, pknic should be in the headline. Markmonitor manages a lot of the most important domains worldwide, so i guess pknic got a very angry call.

Re: .pk registrar hacked, Pakistani sites for Google, MSN, Apple, Ebay redirected

#14

Post by manojlds »

mjschultz wrote: post #10
fmax30 wrote: post #3

Everything is normal here (i'm in pakistan) , google msn ebay all are accessible. So either this story is an outright lie, or the so called hackers might actually be just idiots.

You might still have the correct values in your DNS cache for the sites. It looks like the .pk registrar was hacked and the DNS for these site changed. Since you're in Pakistan, you've probably recently resolved some of these names so you'd get the correct version.

It's ironic that the intention, I gather, was to cripple Pakistan users from accessing these site, but they can still acess the sites, but outside world can't.
Post reply on HN