ICANN and IANA domain names hijacked...

FYI…

- http://blogs.zdnet.com/security/?p=1356
June 26, 2008 - "What happens when the official domain names of the organizations that issue the domain names in general, and provide all the practical guidance on how (to) prevent DNS hijacking, end up having their own domain names hijacked? A wake up call for the Internet community. The official domains of ICANN, the Internet Corporation for Assigned Names and Numbers, and IANA, the Internet Assigned Numbers Authority were hijacked earlier today… NetDevilz left the following message on all of the domains:
“You think that you control the domains but you don’t! Everybody knows wrong. We control the domains including ICANN! Don’t you believe us? haha … (Lovable Turkish hackers group)”…"
- http://www.zone-h.org/content/view/14973/30/
27 June 2008 - "…Hijacked domains include "icann.com", "icann.net", "iana.com" and "iana-servers.com". We reached the defacers by email but they refused to tell us how they changed the DNS records, however a cross-site scripting or cross-site request forgery vulnerability might have been exploited…"

(Screenshots available at the ZDnet URL above.)

Wow… some "leet" guys right there! Sucks to be ICANN!

…Sucks to be ICANN

Wait for somebody else to do the job and you'll see how bad it -can- get.

.

If ICANN was brought down, that wouldn't affect domain names, only if they attacked your Domain Registrar, correct? Regards, Nick Kitmitto

…they refused to tell us how they changed the DNS records, however a cross-site scripting or cross-site request forgery vulnerability might have been exploited…

It appears the forensics on it are incomplete, but eventually it will all come out in the wash. So we'll have to wait on that.

More info…
- http://www.zone-h.org/component/option,com…acer,NetDevilz/
Total attacks: 31 of which 14 single ip and 17 mass defacements

.