Turkish hackers strike websites with DNS hack

05.09.2011
A Turkish hacking group managed to tamper with Internet addressing records over the weekend, redirecting dozens of websites belonging to companies including Microsoft, UPS and Vodafone to a different web pages controlled by the hackers.

, a website that tracks defacements, 186 websites were redirected to a page controlled by "Turkguvenligi." A message on the redirect page read: "4 Sept. We Turkguvenligi declare this day as World Hack­ers Day - Have fun ;) h4ck y0u."

All of the websites were registered through NetNames, which is part of NBT group. NetNames provides DNS (Domain Name System) services for the websites, which is the system used to translates a domain name into an IP address that can be called into a web browser.

Turkguvenligi managed to hack NetName's DNS servers through a SQL injection attack, which involves putting commands into a web-based form to see if the back-end database responds. If those commands aren't scanned for malicious code, an attacker could gain access to the system.

In the case of NetNames, Turkguvenligi put a redelegation order into the company's system and changed the address of the master DNS servers that served data for the websites, according to a statement from NetNames. The attack occurred around 9 p.m. BST on Sunday.

"The rogue name server then served incorrect DNS data to redirect legitimate web traffic intended for customer web sites through to a hacker holding page branded Turkguvenligi," the statement read. "The illegal changes were reversed quickly to bring service back to the customers impacted and the accounts concerned have been disabled to block any further access to the systems."