Pierluigi Paganini September 18, 2017

A hacker using the online moniker of ‘Kuroi’SH’ defaced the Google Brazil domain on Tuesday afternoon, this isn’t the first high-profile target he breached.

A hacker using the online moniker of ‘Kuroi’SH’ defaced the official Google Brazil domain on Tuesday afternoon. The defaced page displayed a message greeting his friends for the successful attack on such a high-profile target.

“It is a great moment to die. Hacked by Kuroi’SH! Two Google at once, I don’t even care; f**k the jealous hates such as Nofawkx. Two Google at once world record idgaf :D. Greets to my friends Prosox & Shinobi h4xor.”

Below the deface page uploaded by the hacker and a video PoC of the hack:

Kuroi’SH successfully uploaded a deface page that remained on the domain for more than 30 minutes.

Kuroi’SH, who proclaims itself as “a half gray hat and white hat” explained that he was also able to control Google Paraguay but he didn’t have time to do it.

I reached Kuroi’SH to ask why he defaced the Google Brazil domain, he told me that it is a demonstrative hack to demonstrate that everything can be hacked.

He highlighted the importance of cyber security and the risks every company online face if underestimate cyber threats.

Google Brazil has also acknowledged the defacement, the company clarified that its systems were not hacker anyway.

“Google has not been hacked. DNS servers may have suffered an attack, redirecting to other sites.” states Google Brazil.

O Google não foi hackeado. Servidores de DNS podem ter sofrido um ataque, redirecionando a outros sites. Sugestão: https://t.co/2vXuWKR0sK

— Google Brasil (@googlebrasil) January 3, 2017

Shortly after the attack, some Brazilian media outlets reported that hacker also defaced Google Maps and Google Translate domains, but Kuroi’SH has denied the involvement in other attacks.

My readers know very well Kuroi’SH, in 2015, he defaced NASA subdomains and published a pro-Palestinian message.

Such kind of attacks could be very dangerous because hackers targeting the DNS can redirect visitors to websites set up to deliver malware or to phishing websites … do not underestimate them!

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Google Brazil, defacement)

[adrotate banner=”12″]