Defacement archive Zone-h gets defaced

January 23, 2007

By John Leyden, The Register

Defacement archive has become the victim of a domain hijack attack.

Initially we thought the site had been defaced, however Zone-h co-founder Roberto Preatoni has been in touch to explain that its DNS settings were illicitly changed to point at a site carrying a "screw you" message, posted by a gang of defacers from Saudi Arabia.

"The website wasn't technically hacked, the attacker gained instead access to the registrant authority admin panel through which zone-h was registered and from there they changed the DNS settings, redirecting the domain name to a different IP. This IP connected a webserver mounting the defacement page," Preatoni explained.

The DNS settings of the site have been set back to their original values which will allow surfers to visit as normal after the correct values propagate across the internet, a process that can sometimes take a few hours. Undoing the unauthorised changes took 48 hours, a length of time Preatoni blames on the time it took its registering authority to analyse the problem.


main page ATTRITION feedback