Re: Nike Site taken over

[aviram () JENIK COM (Aviram Jenik)]

Hi.

> From what I've heard, this sounds like a DNS hijacking attack. I'd be
> interested to know how common this is...
>
> Fromwhat I've heard it's not really a 'DNS hijacking' but rather a change
in Network Solution's registration (domain hijacking).
You'll be amazed how common this is, and what amazes me more is that despite
the fact this is a very easy procedure (take a look at our article called
'Domain Hijacking: A step by step guide':
http://www.securiteam.com/securitynews/Domain_Hijacking__A_step-by-step_guid
e.html )
people do not take the natural step to secure their web sites. This attack
is even easier than your average script-kiddie attack: it doesn't even need
a compiler.

When we published the above article (over 4 months ago) we thought the
domain hijacking wave might change something in either hostmaster's way of
thinking or network solution's authorization procedure. But I guess people
are more interested in placing another bolt on their armored front door
instead of closing their living room window.

Aviram Jenik
Beyond Security Ltd.
http://www.BeyondSecurity.com
http://www.SecuriTeam.com