Hackers deface .com.my and .my sites
An attack on sites with .com.my and .my domains rattled the operations of several companies in Malaysia this morning.
2 July Update: According to an official announcement by MYNIC, all domains have been restored as of 4.38pm yesterday. However a quick check by Yahoo! Malaysia showed that .com.my versions of MSN, Microsoft, Dell, Kaspersky, Bing and Skype were still affected.
An attack on sites with .com.my and .my domains rattled the operations of several companies in Malaysia this morning.
Google, Dell, Microsoft, Kaspersky, Bing, Skype and MSN Malaysia were among the sites that fell victim to ‘TiGER-M@TE’, the alleged culprit. However, users need not worry about private data as the attack only affected the Malaysian domain registry MYNIC and not the websites themselves.
Reports of defaced homepages began trickling in on online forums this morning, causing confusion among social media users who could not access the sites.
The hackers had successfully blocked users from accessing the intended websites, forcing them to see a webpage announcing their hack success.
At the time of writing, some websites have already been restored, while others are still struggling to sort it out.
According to blog Lowyat.net, this is a DNS poisoning attack where users are brought to a temporary, separate page instead of the intended website.
Its founder Vijandren Ramadass said in a post that there is ‘strong reason now to believe that the MYNiC registry data has been compromised as part of the attack’.
“….as such all the domain on the .my suffix are now at risk of malicious attacks,” he said.
According to him, a similar attack had been carried out by the same group on Kenya’s domain registry in April.
Dhillon Kannabhiran, chief executive officer and founder of IT security conference Hack In The Box was quoted on Digital News Asia as saying that the attack is ‘akin to someone changing the number in your phone’s contact list.
“….so when you call the entry that says ‘Office’, instead of calling the office, it dials 1300-GOATSE instead.”
A software analyst from Dell Malaysia has confirmed the attack, but stressed that it was not affecting their business.
‘The incident has been logged,” the analyst told us.
If problem using .my and .com.my persist using DNS queries (8.8.8.8. and 8.8.4.4.) on Google DNS, users may opt to use OpenDNS or switch to server ISP DNS.
Here’s the quickest ‘remedy’. Change your DNS server to:
OpenDNS Home: 208.67.222.222/ 208.67.220.220
Level3: 209.244.0.3/ 209.244.0.4
TMnet/Unifi: 202.188.0.133/202.188.1.
