anonymous un hacklenmesi

türkiyeye mesaj gönderdikten 3 saat sonra hacklendiler bide utanmadan nedenini yazmışlar buyrun:

Here are some facts about what happened to anonops.com today:

First off lets start with the reassurance that nothing off ours was compromised, not at all. In no way were any systems that are owned by us hacked, defaced, nuked, etc. This is a guarantee. Do not be fooled by people who are too incompetent to understand what actually happened, or the psyops that want to drive you away from the network.

What really happened was a hijacking of our DNS for the domain anonops.com. Basically someone seems to be introducing a rogue SOA record for our domain, that is pointing to their name servers. Beyond the fact that there is a rogue SOA being introduced we are unsure how the attacker is managing this. It is entirely possible that a rogue registrar is assisting him, or was compromised to allow him to do this. This is sadly beyond our control.

Lets use our friend dig, you can try this from your own box if you like, to verify my claims:

;; QUESTION SECTION:
;anonops.com. IN SOA

;; ANSWER SECTION:
anonops.com. 80371 IN SOA leah.ns.cloudflare.com. dns.cloudflare.com. (
2013060215 ; serial
10000 ; refresh (2 hours 46 minutes 40 seconds)
2400 ; retry (40 minutes)
604800 ; expire (1 week)
3600 ; minimum (1 hour)
)

Fantastic! This is what our SOA is supposed to be, let me query again though.

;; QUESTION SECTION:
;anonops.com. IN SOA

;; ANSWER SECTION:
anonops.com. 84853 IN SOA garfi1.militanz.com. zvorleyfunky.mail.com. (
2013060302 ; serial
86400 ; refresh (1 day)
7200 ; retry (2 hours)
3600000 ; expire (5 weeks 6 days 16 hours)
86400 ; minimum (1 day)
)

Oh noes! This is not our SOA. Querying the same thing withing 5 seconds returns a different result, there is two SOA's being propogated for our domain, our legit one, and the rogue one. Again, feel free to try this for yourself.

So what does this all mean?

This means that at the moment any records that you retrieve from the anonops.com domain will not be legitimate. It is possible for the attacker to redirect you to wherever he wants to, and gather your IP.

If you want to connect to our IRC, use a direct IP: 199.59.161.30.

Sadly, this shows just how flawed the DNS system is, and how even if your servers are secure, you can get screwed by a third party.