The Syrian Electronic Army claimed Wednesday that it managed to hack into Facebook violating an administrator account of the Facebook’s Domain Registrar.
MarkMonitor Inc. is an American software company which develops software to protect corporate brands from illicit activities including fraud, piracy, counterfeiting and cybersquatting, it is the same domain registrar of Ebay/PayPal. MarkMonitor acquired AllDomains in 2001 and DtecNet in 2010, and it was itself acquired by Thomson-Reuters in 2012.
The Syrian Electronic Army modified the contact information for the Facebook Domain, referring to a Syrian email address on the company’s WHOIS domain information page. Fortunately the hackers failed to hijack the entire Facebook domain, in this case, the attack could have had very serious consequences, the hackers anyway claimed that they have tried to update the nameserver information, but the process had to be abandoned because it was “taking too much time…“.
Probably there are in place, I hope so, procedures to validate any changes to the records, for example, requesting a two-factor authentication to unlock the domain anyway requesting that any change to DNS settings have to be manually verified and authenticated.
If Syrian Electronic Army had succeeded in updating the nameserver record for Facebook, then the millions of users could have been impacted, they could have been redirected to a malicious website serving a malware or to a fake authentication page to capture the users’ credentials.
The Syrian Electronic Army has attacked Facebook because the company removed from its social network the pages managed by dissidents because they violate standards for permitted content, the decision of the company has caused the loss of important information about the conflict.
The deletion of Syrian opposition pages by Facebook removes important information regarding the evolution of the Syrian internal conflict. News regarding the revolution, detailed reportage and also information about the use of chemical weapons in the country.
Facebook has confirmed that no user has been impacted and that it hasn’t observed traffic hijacking. At the time of writing the registrar contact details were restored and the situation is normal.
(Security Affairs – Facebook, Syrian Electronic Army)
