Hacker points Syrian telecom website to AT&T, T-Mobile

The prank also pointed email servers for the Syrian Telecommunication Establishment to Israel and Iran

The website of a Syrian telecommunications provider redirected to AT&T's website and then T-Mobile's on Wednesday, an apparent prank by a hacker who has been probing the country's internet infrastructure for several days.

The website of a Syrian telecommunications provider redirected to AT&T's website and then T-Mobile's on Wednesday, an apparent prank by a hacker who has been probing the country's internet infrastructure for several days.

The website of a Syrian telecommunications provider redirected to AT&T's website and then T-Mobile's on Wednesday, an apparent prank by a hacker who has been probing the country's Internet infrastructure for several days.

The hacker apparently found a way to modify the authoritative DNS (Domain Name System) record for the Syrian Telecommunications Establishment (STE), said Doug Madory, senior analyst with Renesys, a company that monitors global Internet activity.

The style of hack is similar to one that affected The New York Times, Twitter, Sharethis and others on Tuesday when certain domain names they controlled were pointed to an IP address controlled by the Syrian Electronic Army (SEA), a group of pro-Syrian government cyberattackers.

DNS is a distributed database that translates domain names, such as twitter.com, into an IP address that can be called up in a browser.

The DNS server used by STE also runs several other Web services "which is quite unusual for high-profile DNS servers," said Andree Toonk, founder of the network monitoring company, BGPmon.net.

"It's not unlikely the attacker gained access to this machine exploiting one of these services," Toonk said.

The attack on STE also modified the organization's mail exchange (MX) records, which are used to route email messages.

At one point, STE's MX record pointed to a domain in Israel. The record was then changed to point to a mail server run by Iran's presidential office, Madory said. Then the hacker changed it once more to "oliver.tucket.boom."

On Wednesday, The Washington Post published an interview with a person going by the pseudonym "Oliver Tucket," who took credit for a series of attacks on the Syrian's government's infrastructure.

The Post identified him as an American white-collar worker who has sought to embarrass President Bashar al-Assad's regime. A Twitter account, @olivertuckedout, showed several tweets on Sunday claiming attacks against Syria. The person running that Twitter account could not immediately be reached.

It's unlikely that the MX record tampering actually allowed the hacker to intercept emails, although that in theory is possible. Emails directed to another server that is not configured correctly to receive mail would be rejected, Madory said.

The MX record tampering is likely designed "more just to embarrass," Madory said.

Syria's government has waged a long-running, bloody campaign against rebels seeking to topple al-Assad's government. In protest of coverage of the conflict, the SEA has conducted a range of cyberattacks against the websites and Twitter accounts of media outlets such as the Financial Times, the Associated Press, The Guardian, BBC and Al Jazeera.

The SEA's attack on Tuesday compromised a reseller of domain name services affiliated with Australia-based Melbourne IT.

Through a spear phishing email, the group gained account credentials that allowed it to modify authoritative DNS records for many websites, redirecting people to a website in Russia that it controlled.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Tags Syrian Telecommunications Establishmentsecurity

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?