October 14, 2018

Article: "Lenovo, Google websites hijacked by DNS attacks"

When users logged onto the Lenovo website and Google's search engine for Vietnam they were redirected to another page, which featured images of a "bored young man sitting in a bedroom and the song 'Breaking Free'" (PC World).

This was an example of hacking against the DNS (Domain Name System), which uses domain names to find IP addresses to be called into a browser. In this case, Lenovo's hackers changed the domain's registration details to redirect the nameservers at CloudFare. Nameservers tell a computer which IP address to look up when accessing a website. CloudFare servers then redirected users to two IP addresses that were hosted in the Netherlands.

Lenovo had pre-installed an application called Superfish on its laptops, which made it vulnerable and susceptible to a security breach. CloudFare offers free services that are sometimes abused by miscreants.

When Google's Vietnam search site redirected people, it had its domain name registered with Webnic. It is speculated that there was a weakness in Webnic's network that allowed hackers to make changes to domain name registrations, but it is also possible that these hackers obtained credentials used by administrators in Webnic.

Attacks like these are especially dangerous to web users, as the redirects can automatically install malicious software to computers. Domain name registrars have been slowly implementing DNS Security Extensions to better protect domain name records. It uses "public key cryptography to digitally sign domain names and corresponding IP addresses" (PC World). This system can make attacks like the ones against Lenovo and the Vietnam Google browser much more complicated, and essentially prevent attacks.