Pierluigi Paganini February 06, 2014

The Syrian Electronic Army claimed Wednesday that it managed to hack into Facebook violating an administrator account of the Facebook’s Domain Registrar.

MarkMonitor Inc. is an American software company which develops software to protect corporate brands from illicit activities including fraud, piracy, counterfeiting and cybersquatting, it is the same domain registrar of Ebay/PayPal. MarkMonitor acquired AllDomains in 2001 and DtecNet in 2010, and it was itself acquired by Thomson-Reuters in 2012.

The Syrian Electronic Army modified the contact information for the Facebook Domain, referring to a Syrian email address on the company’s WHOIS domain information page. Fortunately the hackers failed to hijack the entire Facebook domain, in this case, the attack could have had very serious consequences, the hackers anyway claimed that they have tried to update the nameserver information, but the process had to be abandoned because it was “taking too much time…“.

Probably there are in place, I hope so, procedures to validate any changes to the records, for example, requesting a two-factor authentication to unlock the domain anyway requesting that any change to DNS settings have to be manually verified and authenticated.

If Syrian Electronic Army had succeeded in updating the nameserver record for Facebook, then the millions of users could have been impacted, they could have been redirected to a malicious website serving a malware or to a fake authentication page to capture the users’ credentials.