Malaysia Airlines confirms hacking of domain name system; says bookings and data unaffected

Published on Jan 26, 2015 1:57 PM                     

         

Ricky Lim · Singapore

Look like a DNS poisoning at the service provider level.
Secure DNS (DNSSec) for DNS entry record will have prevented this DNS cache poisoning.

Reply · Like

Ricky Lim · Singapore

Some data was also stolen.
Then APT - Advanced Persistent Threat measure should have been taken - to tackle known threat, unknown threat, sandbox detonation.

Reply · Like

Ricky Lim · Singapore

WAF/IPS - Web Application Firewall and Intrusion Prevention System should also have been put in place - to prevent the stealing of the data from the Web services database.

Reply · Like

Carl Ng · Kuala Lumpur, Malaysia

hehehehe i wonder who has access to modify the provider DNS to MAS... lol

Reply · Like

· Unfollow Post · 5 hours ago

• 

  Ricky Lim · Singapore

  Service provider DNS too trusting with other DNS server update and a false dns record is updated and re-directed to the hacker website.
  
  Using secure dns - with pki for key exchange of trusted dns servers - will have prevented the dns cache poisoning by the hacker (who is an unauthorised source - to amend the airline dns record entry).

  Reply · Like

Ricky Lim · Singapore

I thinks its service provider is Akami Tech

Reply · Like

0users liked this commentThumbs UpThumbs Down0users disliked this comment

ricky l • a second agoRemove

And the 404 - refer to the HTTP response code for "Web page not found".