MYNIC, the local domain authority service has released a statement confirming that their website has indeed been hacked yesterday. They say that they discovered some “problems” with their system and MYNIC Computer Security Incident Response Team is on the case.
The MYNIC domain records has been changed without authorization(obviously) which several people had already discovered earlier when changing their DNS server did not fix the problem.
All of the affected domains has been restored to the correct information at 4.38 pm, Monday.
Here is an explanation of how MYNIC, an authority domain server works:
1. MYNIC would store the domain records, paired with the server host address.
2. Other DNS such as Google and OpenDNS would update their record by asking MYNIC, since MYNIC is an authoritative local server.
3. Users would ask any one of this servers for a DNS lookup in order to get connected to the webserver.
4. MYNIC’s records was compromised, pointing several domains to a fake server that shows the defaced image.
5. Other DNS was also compromised because they also update their DNS records from MYNIC.
6. This result in a chain reaction or rather a simultaneous corruption by corrupting the main local DNS records server.
This is again, not a attacking-hacking incident but a hijack by redirecting all the traffic of a certain web pages to another place, which is why you see the defaced websites.
Take the best example is a highway robbery where your GPS got pointed to another destination.
Link for the official statement given by thesslmart.com.my : )
Thanks.
Like our Facebook Page here at NasiLemakTech.com for more news and in-depth reviews! Also, join our Facebook Group for insightful information and memes!
Subscribe to our YouTube channel too!
