Hacker points Syrian telecom website to AT&T, T-Mobile

The website of a Syrian telecommunications provider redirected to AT&T's website and then T-Mobile's on Wednesday, an apparent prank by a hacker who has been probing the country's Internet infrastructure for several days.

The hacker apparently found a way to modify the authoritative DNS (Domain Name System) record for the Syrian Telecommunications Establishment (STE), said Doug Madory, senior analyst with Renesys, a company that monitors global Internet activity.

The style of hack is similar to one that affected The New York Times, Twitter, Sharethis and others on Tuesday when certain domain names they controlled were pointed to an IP address controlled by the Syrian Electronic Army (SEA), a group of pro-Syrian government cyberattackers.

DNS is a distributed database that translates domain names, such as twitter.com, into an IP address that can be called up in a browser.

The DNS server used by STE also runs several other Web services "which is quite unusual for high-profile DNS servers," said Andree Toonk, founder of the network monitoring company, BGPmon.net.

"It's not unlikely the attacker gained access to this machine exploiting one of these services," Toonk said.

The attack on STE also modified the organization's mail exchange (MX) records, which are used to route email messages.

At one point, STE's MX record pointed to a domain in Israel. The record was then changed to point to a mail server run by Iran's presidential office, Madory said. Then the hacker changed it once more to "oliver.tucket.boom."

On Wednesday, The Washington Post published an interview with a person going by the pseudonym "Oliver Tucket," who took credit for a series of attacks on the Syrian's government's infrastructure.

The Post identified him as an American white-collar worker who has sought to embarrass President Bashar al-Assad's regime. A Twitter account, @olivertuckedout, showed several tweets on Sunday claiming attacks against Syria. The person running that Twitter account could not immediately be reached.

It's unlikely that the MX record tampering actually allowed the hacker to intercept emails, although that in theory is possible. Emails directed to another server that is not configured correctly to receive mail would be rejected, Madory said.

The MX record tampering is likely designed "more just to embarrass," Madory said.

Syria's government has waged a long-running, bloody campaign against rebels seeking to topple al-Assad's government. In protest of coverage of the conflict, the SEA has conducted a range of cyberattacks against the websites and Twitter accounts of media outlets such as the Financial Times, the Associated Press, The Guardian, BBC and Al Jazeera.

The SEA's attack on Tuesday compromised a reseller of domain name services affiliated with Australia-based Melbourne IT.

Through a spear phishing email, the group gained account credentials that allowed it to modify authoritative DNS records for many websites, redirecting people to a website in Russia that it controlled.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

View the original article here

Will Smith makes unexpected appearance at Defcon hacker conference

American actor Will Smith captured the attention of Defcon attendees when he showed up unexpectedly at the hacker conference on Sunday apparently to do research for an upcoming movie.

The actor attended a talk that featured Apollo Robbins, a renowned sleight-of-hand artist, security consultant and entertainer, who is best known for picking the pockets of Secret Service agents during an encounter with U.S. President Jimmy Carter.

Smith came at the invitation of Robbins, who is coaching him for an upcoming movie, said Chris Hadnagy, the CEO of social engineering consultancy and training firm Social-Engineer and organizer of the Defcon social engineering contest.

According to Hadnagy, Smith was brought in through a back door so he can sit in and hear the talk that he, Robbins and Michele Fincher, another Social-Engineer representative, gave.

The talk included a demonstration of Robbins' skills, as he called an attendee to the stage and stole his watch, wallet and mobile phone in front of the crowd.

Smith was so impressed with Defcon that he decided to walk around, Hadnagy said. "We went to the vendor area and showed him lock picks, RFID (radio-frequency identification) stuff, Pwnie Express [hacking equipment] -- he was thoroughly impressed."

Smith then visited the Social Engineering Capture the Flag contest room where he greeted some people, gave some autographs and took some pictures, Hadnagy said.

"We showed him some things we did for our [social engineering] class," Hadnagy said. "He was very interested in how profiling people is done and social engineering. He wanted to understand the human part of hacking."

Smith had to leave after 20 minutes, otherwise he risked getting mobbed, Defcon founder Jeff Moss said.

There were about 15,000 attendees at Defcon this year, according to the organizers.

It's not clear if Smith was at the conference doing research for a role in an upcoming movie or for a movie that he plans to produce.

Smith didn't share the name of the movie, but said that it's likely that it will be made, Moss said.

Some pictures of Smith at the conference accompanied by Jeff Moss were posted by attendees on Twitter.

View the original article here