13 ms·

Malaysia Airlines Defaced - 404 Plane Not Found

47 points by scubasteve 12y ago

mintplant 12y ago
> hacked by a group claiming be aligned with the Islamic State extremist group > hackers claiming to be similarly aligned with the Islamic State extremist group This is either really dishonest or really stupid reporting. They're not actually aligning themselves with ISIS. They're just trolls trying to be edgy.
- zerocrates 12y ago
  I don't see how it's dishonest. Whatever their actual alignment and/or edgy-troll status, they still claimed to be aligned with ISIS, just as the article says.
  - potatolicious 12y ago
    The job of a journalist is to fact-check and separate fact from fiction. Which is to say, when the subject of an article claims something, you should probably not print it verbatim without thinking it through at least a little bit, and maybe determine the credibility of what's being said. It is not the job of a journalist to regurgitate sources blindly. Otherwise... hey journalists, I am literally the second coming of Jesus, you guys should interview me and tell people I'm the Son of God.
    - ryanlol 12y ago
      How can the journalist reliably evaluate who "Lizard Squad" is aligned with, especially with them repeatedly claiming to support ISIS?
    - mryan 12y ago
      > Otherwise... hey journalists, I am literally the second coming of Jesus, you guys should interview me and tell people I'm the Son of God. Right, and in that case the article would probably read "potatolicious, who claims to be the second coming of Jesus..." * Their claim of alignment with ISIS is, in itself, a part of the story. They are reporting that the claims have been made, not that the claims are factually correct. * This actually happened on British TV: https://www.youtube.com/watch?v=qlSj_imnv7o https://www.youtube.com/watch?v=qlSj_imnv7o
    - DanBC 12y ago
      In your example journalists would say that you claim to be the son of god. They wouldn't say that you are the son of god. You seem to be asking journalists to say "he claims to be the son of god (but he isn't, obvs)" which is asking th journalists to provide information they don't have.
      - marvin 12y ago
        My local newspaper stretched it a bit further by saying that the website was defaced bt "sympathizers of IS". Which is doubly funny, because they obviously took the bait.
    - Lazare 12y ago
      > hacked by a group claiming be aligned with the Islamic State extremist group The article claims that the website was hacked by a group claiming to be aligned with the Islamic State. > hey journalists, I am literally the second coming of Jesus, you guys should interview me and tell people I'm the Son of God. Good journalism would be to report that you are claiming to be Jesus. Which is what happened here; they reported a claim of affiliation, not the affiliation as a fact. It would actually be bad journalism for the reporter to take a position on your divinity (or an unknown groups actual affiliation with IS).
      - _xzu 12y ago
        Traditionally good journalism includes credibility checks and at least gives some kind of possibility to see uncertain facts in bigger context. Just reporting ( alarming / scandalous ) claims have been usually called tabloid journalism.
jrockway 12y ago
"Hey everyone, go visit this website that's probably serving malware!"
- ryanlol 12y ago
  A simple curl reveals that it isn't... And how often are deface pages serving malware anyways? IMO it would be much more sensible to serve malware off of a page that _doesn't_ announce it has been hacked.
  - mschuster91 12y ago
    Not really. A defaced high profile website will draw visitors e.g. from all major news sites, maybe even TV. Combined with a couple 0days or a browser exploit kit, quite a chance to infiltrate a target. And if you're lucky the online reporters also have twitter/fb account info on their PCs. I guess this is how the various compromises of twitter accounts have been done.
- anon1385 12y ago
  Google ads regularly serve malware[1], are you going to tell people not to visit Google? [1] https://news.ycombinator.com/item?id=8879229 https://news.ycombinator.com/item?id=8879229
  - tombrossman 12y ago
    This isn't the best way to describe the problem or solution. Users can be advised to install an ad-blocking plugin for their web browser to protect themselves. Since Google serves adverts from domains other than google.com, users can continue to use the google.com domain for search while at the same time blocking the malware coming from ad networks.
- Daviey 12y ago
  Are you referring to contents of the linked article or that this is on HN? Need more words. Surely, if the second - linking to wsj isn't known to serve malware. Further, if you do not have some trust in your browser to go to potentially compromising sites - you need to change browser or stop browsing.
ryanlol 12y ago
Interestingly enough, despite malaysia airlines claiming that this is just a DNS hijack. It appears that their own CDN (Akamai) is now serving the deface page. (The page was being served by cloudflare before)
- JoshTriplett 12y ago
  Many CDNs work by retrieving the page themselves, caching it, and re-delivering on request. In that case, if the original page changes, the CDN would automatically change too.
  - ryanlol 12y ago
    Which would imply that their backend was compromised, not just DNS.
    - zkhalique 12y ago
      The CDN could have simply refreshed its DNS cache couldn't it? That would mean it loaded the files from somewhere else.
      - ryanlol 12y ago
        Unless there was something horribly wrong with their setup, akamai would have prevented that from happening.
        Tiksi 12y ago
        I'm not sure how they are supposed to prevent this. If you have access to the dns, you can change the record for the origin server that the cdn pulls from. Nothing "horribly wrong" with that.
        ryanlol 12y ago
        Akamai makes you to set your own DNS server for it to pull records from, the domain getting hijacked should not have any effect on what that DNS server is returning.
Buge 12y ago
HSTS could prevent this from working.
- ryanlol 12y ago
  Not really, the page is being served from MAS's own servers now.
  - Dylan16807 12y ago
    Not if the other comment by... you... about it being served by an external CDN is correct. HSTS could easily stop a CDN from picking up a bad version during a DNS hijack.
    - ryanlol 12y ago
      MAS's CDN that is. The same CDN they were using before the hack even happened.
      - Dylan16807 12y ago
        But it being an external CDN means that there is no indication that the actual servers they have control of were tampered with. The possibility that HSTS could have saved the day is just as valid. There is no indication that the CDN got these incorrect files with any kind of encryption or signing.
        ryanlol 12y ago
        So CDN just works without having the SSL certs?
        Dylan16807 12y ago
        What? A CDN accessed over TLS needs some kind of cert, sure. I don't see how this connects to whether the CDN pulls off the wrong server. Obviously if the CDN has cert X then any authentication it may have should use cert Y.
whizzkid 12y ago
"The browser window of the website" It is the first time i am hearing such a definition.
- decentrality 12y ago
  I enjoyed the sole comment on the article at the time too: "It's 'homepage' not 'browser window'... unless you're 80"
  - jobigoud 12y ago
    It's actually called "Page title" though.
- kalleboo 12y ago
  I reacted to the CNN article[0] which said "The browser tab read" [0]http://edition.cnn.com/2015/01/25/asia/malaysia-airlines-website-hacked/ http://edition.cnn.com/2015/01/25/asia/malaysia-airlines-web...
corobo 12y ago
Bad as the deface is, they're making decent looking takeover pages these days. Not too bad that design Take away the greetz and the embarrassment and you're halfway to a snazzy landing page
- scubasteve 12y ago
  The second defacement reminded me of a geocities page with music playing in the background. Reference: http://www.nbcnews.com/storyline/isis-terror/lizard-squad-claims-it-hacked-malaysia-airlines-website-n293461 http://www.nbcnews.com/storyline/isis-terror/lizard-squad-cl...

47 points by scubasteve 12y ago

> hacked by a group claiming be aligned with the Islamic State extremist group > hackers claiming to be similarly aligned with the Islamic State extremist group This is either really dishonest or really stupid reporting. They're not actually aligning themselves with ISIS. They're just trolls trying to be edgy.

zerocrates 12y ago
I don't see how it's dishonest. Whatever their actual alignment and/or edgy-troll status, they still claimed to be aligned with ISIS, just as the article says.
- potatolicious 12y ago
  The job of a journalist is to fact-check and separate fact from fiction. Which is to say, when the subject of an article claims something, you should probably not print it verbatim without thinking it through at least a little bit, and maybe determine the credibility of what's being said. It is not the job of a journalist to regurgitate sources blindly. Otherwise... hey journalists, I am literally the second coming of Jesus, you guys should interview me and tell people I'm the Son of God.
  - ryanlol 12y ago
    How can the journalist reliably evaluate who "Lizard Squad" is aligned with, especially with them repeatedly claiming to support ISIS?
  - mryan 12y ago
    > Otherwise... hey journalists, I am literally the second coming of Jesus, you guys should interview me and tell people I'm the Son of God. Right, and in that case the article would probably read "potatolicious, who claims to be the second coming of Jesus..." * Their claim of alignment with ISIS is, in itself, a part of the story. They are reporting that the claims have been made, not that the claims are factually correct. * This actually happened on British TV: https://www.youtube.com/watch?v=qlSj_imnv7o https://www.youtube.com/watch?v=qlSj_imnv7o
  - DanBC 12y ago
    In your example journalists would say that you claim to be the son of god. They wouldn't say that you are the son of god. You seem to be asking journalists to say "he claims to be the son of god (but he isn't, obvs)" which is asking th journalists to provide information they don't have.
    - marvin 12y ago
      My local newspaper stretched it a bit further by saying that the website was defaced bt "sympathizers of IS". Which is doubly funny, because they obviously took the bait.
  - Lazare 12y ago
    > hacked by a group claiming be aligned with the Islamic State extremist group The article claims that the website was hacked by a group claiming to be aligned with the Islamic State. > hey journalists, I am literally the second coming of Jesus, you guys should interview me and tell people I'm the Son of God. Good journalism would be to report that you are claiming to be Jesus. Which is what happened here; they reported a claim of affiliation, not the affiliation as a fact. It would actually be bad journalism for the reporter to take a position on your divinity (or an unknown groups actual affiliation with IS).
    - _xzu 12y ago
      Traditionally good journalism includes credibility checks and at least gives some kind of possibility to see uncertain facts in bigger context. Just reporting ( alarming / scandalous ) claims have been usually called tabloid journalism.

jrockway 12y ago

"Hey everyone, go visit this website that's probably serving malware!"

ryanlol 12y ago
A simple curl reveals that it isn't... And how often are deface pages serving malware anyways? IMO it would be much more sensible to serve malware off of a page that _doesn't_ announce it has been hacked.
- mschuster91 12y ago
  Not really. A defaced high profile website will draw visitors e.g. from all major news sites, maybe even TV. Combined with a couple 0days or a browser exploit kit, quite a chance to infiltrate a target. And if you're lucky the online reporters also have twitter/fb account info on their PCs. I guess this is how the various compromises of twitter accounts have been done.
anon1385 12y ago
Google ads regularly serve malware[1], are you going to tell people not to visit Google? [1] https://news.ycombinator.com/item?id=8879229 https://news.ycombinator.com/item?id=8879229
- tombrossman 12y ago
  This isn't the best way to describe the problem or solution. Users can be advised to install an ad-blocking plugin for their web browser to protect themselves. Since Google serves adverts from domains other than google.com, users can continue to use the google.com domain for search while at the same time blocking the malware coming from ad networks.
Daviey 12y ago
Are you referring to contents of the linked article or that this is on HN? Need more words. Surely, if the second - linking to wsj isn't known to serve malware. Further, if you do not have some trust in your browser to go to potentially compromising sites - you need to change browser or stop browsing.

ryanlol 12y ago

Interestingly enough, despite malaysia airlines claiming that this is just a DNS hijack. It appears that their own CDN (Akamai) is now serving the deface page. (The page was being served by cloudflare before)

JoshTriplett 12y ago
Many CDNs work by retrieving the page themselves, caching it, and re-delivering on request. In that case, if the original page changes, the CDN would automatically change too.
- ryanlol 12y ago
  Which would imply that their backend was compromised, not just DNS.
  - zkhalique 12y ago
    The CDN could have simply refreshed its DNS cache couldn't it? That would mean it loaded the files from somewhere else.
    - ryanlol 12y ago
      Unless there was something horribly wrong with their setup, akamai would have prevented that from happening.
      - Tiksi 12y ago
        I'm not sure how they are supposed to prevent this. If you have access to the dns, you can change the record for the origin server that the cdn pulls from. Nothing "horribly wrong" with that.
        ryanlol 12y ago
        Akamai makes you to set your own DNS server for it to pull records from, the domain getting hijacked should not have any effect on what that DNS server is returning.

Buge 12y ago

HSTS could prevent this from working.

ryanlol 12y ago
Not really, the page is being served from MAS's own servers now.
- Dylan16807 12y ago
  Not if the other comment by... you... about it being served by an external CDN is correct. HSTS could easily stop a CDN from picking up a bad version during a DNS hijack.
  - ryanlol 12y ago
    MAS's CDN that is. The same CDN they were using before the hack even happened.
    - Dylan16807 12y ago
      But it being an external CDN means that there is no indication that the actual servers they have control of were tampered with. The possibility that HSTS could have saved the day is just as valid. There is no indication that the CDN got these incorrect files with any kind of encryption or signing.
      - ryanlol 12y ago
        So CDN just works without having the SSL certs?
        Dylan16807 12y ago
        What? A CDN accessed over TLS needs some kind of cert, sure. I don't see how this connects to whether the CDN pulls off the wrong server. Obviously if the CDN has cert X then any authentication it may have should use cert Y.

whizzkid 12y ago

"The browser window of the website" It is the first time i am hearing such a definition.

decentrality 12y ago
I enjoyed the sole comment on the article at the time too: "It's 'homepage' not 'browser window'... unless you're 80"
- jobigoud 12y ago
  It's actually called "Page title" though.
kalleboo 12y ago
I reacted to the CNN article[0] which said "The browser tab read" [0]http://edition.cnn.com/2015/01/25/asia/malaysia-airlines-website-hacked/ http://edition.cnn.com/2015/01/25/asia/malaysia-airlines-web...

corobo 12y ago

Bad as the deface is, they're making decent looking takeover pages these days. Not too bad that design Take away the greetz and the embarrassment and you're halfway to a snazzy landing page

scubasteve 12y ago
The second defacement reminded me of a geocities page with music playing in the background. Reference: http://www.nbcnews.com/storyline/isis-terror/lizard-squad-claims-it-hacked-malaysia-airlines-website-n293461 http://www.nbcnews.com/storyline/isis-terror/lizard-squad-cl...