Pro-Palestinian hackers managed to conduct DNS redirection attacks on the websites of popular mobile messaging service WhatsApp, as well as security companies AVG and Avira.

The Anonymous-affiliated hacking group, calling itself KDMS, claimed responsibility for the attacks on Twitter, delivering pro-Palestinian defacement messages ending in the words “long live Palestine.”

Network Solutions seems to have let the side down

All three websites seem to be the victim of an attack on Network Solutions, a domain name registrar and website hosting company. It is unclear whether emails from WhatsApp could have been intercepted.

“It appears that our account used to manage the DNS records registered at Network Solutions has received a fake password-reset request not being initiated by anyone at Avira. Network Solutions appears to have honoured this request and allowed a third party to assume control of our DNS,” said Sorin Mustaca of Avira in a statement.

DNS records provide a routing lookup for the internet: they tell computers where to find servers or other computers. Changing the DNS record can misdirect all the traffic that relies on it; and because changes in DNS records propagate around the internet between the servers, their effects can last for days even after the original change has been undone.

The KDMS group also claimed responsibility for an attack on Leaseweb, a hosting company with around 4% of the global internet traffic under its management, and successfully effected a DNS redirect for its homepage.

DNS redirection hacks have become increasingly popular with hackers as sites have improved their own security. The New York Times and Twitter were hit by a DNS attack in August by the self-styled Syrian Electronic Army. Twitter previously suffered a DNS hack in 2009 at the hands of a group calling itself the “Iranian Cyber Army” while the DNS records of many websites, including the Daily Telegraph, the Register and UPS, were redirected in 2011 by a Turkish hacker group.

“Network Solutions seems to have let the side down for all three sites,” independent security expert Graham Cluley told the Guardian. “Somehow hackers gained access to the DNS records of Network Solutions, possibly through a simple password reset request, and managed to redirect the domain names of the three companies to the hacker’s websites.”

A possibility of data leakage

While the redirection of visitors and defacement of website is embarrassing for the companies affected, “there’s also the possibility of data leakage, as the DNS hack could have affected email as well,” according to Cluley.

WhatsApp’s mobile messaging services seemed to be unaffected, apart from the company’s main site, the consequences for AVG and Avira could have been more severe, however, potentially affecting their computer antivirus security products.

“With regard to the antivirus companies, AVG and Avira, there’s also the possibility that program updates could have been poisoned if the companies use domain names as part of their update procedures, although there’s likely to be a series of checks and verifications to avoid that within the update procedure,” Cluley explained.

All three websites have since been recovered, with the propagation of their DNS corrections currently underway across the internet.