22 Dec

DNS hack of Google, Facebook & more sites in .bd

Yesterday Google’s Bangladeshi website google.com.bd was hacked and this happened via DNS. It was reported on the bdNOG mailing list at morning in a thread started by Mr Omar Ali where he shared this screenshot:

 

 

This clearly shows how authoritative DNS for “com.bd.” (which is same as bd. btw) was poisoned and was reflecting attackers authoritative DNS. Later Mr Farhad Ahmed posted a screenshot of google.com.bd showing hackers page:

 

 

Later Mr Sumon Ahmed mentioned that it happened because web frontend of .bd was compromised. This was an interesting hijack as attacker attacked the key infrastructure of the registry instead of Google or Facebook servers. It’s also a warm reminder of the way DNS depends on the hierarchal structure by design and at this stage, we need to focus on DNSSEC to add on the security to the current system.

 

Lately .bd domain faced issues multiple time this year. I hope it will have a good stable time in the upcoming year. In terms of stability it is being backed by PCH’s anycast infrastructure but PCH’s DNS servers are just published in NS records of it’s existing auth servers, but not on the parent zone (which is root zone). Thus the point of failure remains and is yet to be fixed.

 

 

2 thoughts on “DNS hack of Google, Facebook & more sites in .bd

  1. The “passive DNS” service DNSDB clearly shows the hijacking:

    ;; bailiwick: com.bd.
    ;; count: 0
    ;; first seen: 2016-12-20 07:10:17 -0000
    ;; last seen: 2016-12-20 07:10:17 -0000
    google.com.bd. IN NS ns1.phpvibe.net.
    google.com.bd. IN NS ns2.phpvibe.net.

    ;; bailiwick: com.bd.
    ;; count: 1
    ;; first seen: 2016-12-20 01:40:26 -0000
    ;; last seen: 2016-12-20 05:52:10 -0000
    google.com.bd. IN NS ns601.dnsserverboot.com.
    google.com.bd. IN NS ns602.dnsserverboot.com.

    (Real Google name servers are always in google.com)

    Because of caching, the information from the hijacker lasted. Here are measurements with the RIPE Atlas probes in Bangladesh and in India, hours after it was fixed at the registry:

    % atlas-resolve -r 500 -c BD -t NS google.com.bd
    [ns1.google.com. ns2.google.com. ns3.google.com. ns4.google.com.] : 9 occurrences
    [TIMEOUT(S)] : 1 occurrences
    [ns601.dnsserverboot.com. ns602.dnsserverboot.com.] : 5 occurrences
    Test #6970468 done at 2016-12-20T08:39:59Z

    % atlas-resolve -r 500 -c IN -t NS google.com.bd
    [ns1.google.com. ns2.google.com. ns3.google.com. ns4.google.com.] : 19 occurrences
    [ns1.phpvibe.net. ns2.phpvibe.net.] : 4 occurrences
    [ns601.dnsserverboot.com. ns602.dnsserverboot.com.] : 8 occurrences
    Test #6970476 done at 2016-12-20T08:40:10Z

Leave a Reply