grandeduc - Fotolia
How did OurMine hackers use DNS poisoning to attack WikiLeaks?
The OurMine hacking group recently used DNS poisoning to attack WikiLeaks and take over its web address. Learn how this attack was performed from expert Nick Lewis.
WikiLeaks was attacked by the hacking group known as OurMine, which used domain name system (DNS) poisoning to...
Continue Reading This Article
Enjoy this article as well as all of our content, including E-Guides, news, tips and more.
take over WikiLeaks' web address. What is DNS poisoning, and how was OurMine able to pull off this attack?
While network security doesn't make headlines as often as data breaches or incident responses, it can still embarrass an organization when it does. Likewise, there are not as many resources devoted to the subject, which makes it an easy target for attackers.
One example is when WikiLeaks was targeted by OurMine in an attack that used DNS cache poisoning to redirect WikiLeaks' website to a webpage hosted by the hacker group.
However, this is not the first time that WikiLeaks has been targeted -- they have also suffered from distributed denial-of-service attacks. These attacks -- along with Border Gateway Protocol attacks -- use network vulnerabilities against the enterprise. But, with enterprises moving toward the cloud and externally hosted systems, network security could have a larger impact.
In this WikiLeaks attack, OurMine targeted the DNS provider with a DNS poisoning attack, which is when a malicious DNS entry is cached on a specific DNS server. However, DNS servers save a copy of the cache of all the names and IPs that users look up to improve performance, so they don't have to look up something that is requested frequently.
OurMine was able to pull off this attack because the group had its web server address cached on the targeted DNS server in the place of the legitimate WikiLeaks DNS address. This resulted in anyone that used that DNS server being redirected from the legitimate WikiLeaks DNS address to the OurMine web server. It was not a direct attack on the WikiLeaks server, but on the supporting systems on which WikiLeaks relies.
To better understand the risk of a network security-related attack, enterprises may want to perform a risk assessment.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Application and platform security
Related Q&A from Nick Lewis
What are port scan attacks and how can they be prevented?
Port scans provide data on how networks operate. In the wrong hands, this info could be part of a larger malicious scheme. Learn how to detect and ... Continue Reading
Explore benefits and challenges of cloud penetration testing
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
What are the best criteria to use to evaluate cloud service providers?
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading