.edu register hacked led to MIT.edu hack

Even .edu domains aren’t safe from hackers as the registry for .edu domain names got hacked yesterday and this led to MIT having their site hacked and brought down again. All sub domains were also down.

Would this have happened if MIT were using a dot com?

MIT actually own the domain name MIT.com but it doesn’t resolved you would think that having some of the smartest people in the world attending MIT they would at least redirect the traffic from MIT.com to MIT.edu, Mit.com clearly has some type in traffic as there Alexa ranking is 2,399,739

Wondering who runs the .edu the company is called EDUCAUSE, I didn’t know this you can visit them here or visit there wiki page.

You can read more about the story below from the MIT Tech Website.

“MIT was hacked yesterday shortly before noon, with MIT URLs redirecting to a webpage claiming credit for the attack in remembrance of Aaron Swartz. MIT’s email was also diverted.

As a result of the hack, people who tried to reach MIT over the Internet outside the MIT network were redirected to a hacked web page, and some emails may have been lost or delayed. The hack affected all names under mit.edu, such as web.mit.edu, tech.mit.edu, etc. Activity within MIT was not believed to be affected by this attack.

The hack and subsequent outages were due to a configuration change at EDUCAUSE, the registrar that provides information on all names that end in .edu. A registrar, which allows users to purchase domain names, also specifies the domain name system (DNS) servers for a domain, which convert domain names to IP addresses needed to actually load the page. It is unclear how the hackers gained control of MIT’s information at EDUCAUSE.

Because of the attack, the EDUCAUSE registry listed the name of the administrative contact for mit.edu as “I got owned,” and the name servers were changed to CloudFlare servers, an external DNS provider.

Chronology

From 11:58 a.m. to 1:05 p.m., MIT’s DNS was redirected from MIT’s own servers to CloudFlare, where the hackers had configured servers to return a Harvard IP address for all mit.edu queries, except email. The Harvard machine returned a web page that showed “R.I.P. Aaron Swartz, Hacked by grand wizard of Lulzsec, Sabu, God bless America, Down with Anonymous.” (see photo.) A continuously looping chiptunes version of the National Anthem also played. The hackers also signed their names (“hacked by aush0k and tibitximer”) over text from Aaron Swartz’ blog post titled “Immoral” in the background.

Unlike previous attacks, which temporarily disabled some services, this attack had the potential to be much more severe. Email was specifically affected. Mail is normally received by one of nine different MIT servers; however today, mail that was sent between 11:58 a.m. and 1:05 p.m. was directed to a machine at KAIST, Korea Advanced Institute of Science and Technology, meaning the attackers had complete control of emails successfully sent during that time. It is unclear what percentage of emails were successfully transmitted during this time. It is assumed that the machines at Harvard and KAIST were compromised and that Harvard and KAIST were not responsible for the attack.

Some time before 1 p.m., CloudFlare stopped directing non-email traffic to Harvard and sent it all to MIT’s main web server, 18.9.22.69. All traffic to any part of MIT went to that server — for example, going to csail.mit.edu would return MIT’s homepage, which is not normal behavior.

By 1:05 p.m. EDUCAUSE had corrected its listing of MIT’s DNS servers, from CloudFlare back to MIT’s own servers. However, any machines that accessed mit.edu during that hour could have cached the wrong mapping and would continue to refer all queries to CloudFlare for the next 48 hours.

At 4:20 p.m., with information from MIT, CloudFlare started returning the correct addresses for all mit.edu queries, except for email. By 7:15 p.m., CloudFlare removed the “mail.mit.edu” record, which referred to the machine handling MIT email at KAIST. It is unclear whether MIT email went to KAIST between 4:20 p.m. and 7:15 p.m.

This is not the first time MIT has been hacked since Swartz’ death. On Sunday, Jan. 13, MIT experienced a network outage due to a DoS attack. And on Saturday, Jan. 19, MIT’s email went down for 10 hours due to a “mail loop caused by a series of malformed email messages,” according to the MIT News Office.

MIT spokeswoman Kimberly C. Allen said that Information Services & Technology became aware of an issue affecting mit.edu domain registration at 11:58 a.m. this morning. “IS&T was made aware of the problem via automated email from the domain registrar to MIT indicating that MIT’s Domain Name Servers (DNS) had been changed. MIT’s domain rights and the mit.edu domain were returned to MIT’s control at 1:05 pm.”

John A. Hawkinson contributed to this article.

A previous version of this article ran on the web at http://tech.mit.edu/V132/N62/hack.html.”