WikiLeaks was attacked by the hacking group known as OurMine, which used domain name system (DNS) poisoning to...
take over WikiLeaks' web address. What is DNS poisoning, and how was OurMine able to pull off this attack?
While network security doesn't make headlines as often as data breaches or incident responses, it can still embarrass an organization when it does. Likewise, there are not as many resources devoted to the subject, which makes it an easy target for attackers.
One example is when WikiLeaks was targeted by OurMine in an attack that used DNS cache poisoning to redirect WikiLeaks' website to a webpage hosted by the hacker group.
However, this is not the first time that WikiLeaks has been targeted -- they have also suffered from distributed denial-of-service attacks. These attacks -- along with Border Gateway Protocol attacks -- use network vulnerabilities against the enterprise. But, with enterprises moving toward the cloud and externally hosted systems, network security could have a larger impact.
In this WikiLeaks attack, OurMine targeted the DNS provider with a DNS poisoning attack, which is when a malicious DNS entry is cached on a specific DNS server. However, DNS servers save a copy of the cache of all the names and IPs that users look up to improve performance, so they don't have to look up something that is requested frequently.
OurMine was able to pull off this attack because the group had its web server address cached on the targeted DNS server in the place of the legitimate WikiLeaks DNS address. This resulted in anyone that used that DNS server being redirected from the legitimate WikiLeaks DNS address to the OurMine web server. It was not a direct attack on the WikiLeaks server, but on the supporting systems on which WikiLeaks relies.
To better understand the risk of a network security-related attack, enterprises may want to perform a risk assessment.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Web server threats and application attacks
Related Q&A from Nick Lewis
A new remote access Trojan called UBoatRAT was found spreading via Google services and GitHub. Learn how spotting command-and-control systems can ... Continue Reading
CyberArk researchers created an attack called Golden SAML that uses Mimikatz techniques and applied it to a federated environment. Learn more about ... Continue Reading
The use of botnets to spread Scarab ransomware intensifies the threat for enterprises. Discover the best way to respond to such a threat and protect ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.