THE PAKISTAN domain name registry PKNIC plans to take on the mass defacements that spread over 300 websites last weekend.
The defacements spread over the .pk domain like a wave over the weekend and crashed over local pages for Ebay, Apple, Yahoo, Google and others. At the time the company that administers the domain did not comment, but now that it has spoken with its customers, it has provided some explanation.
It said that four user accounts were breached via a vulnerability exploit late on Friday 23 November. It said that no user data was compromised and that its servers were not hacked. The vulnerability has been fixed and the four affected DNS accounts returned to normal.
"We take the security of our servers and client data very seriously, and routinely study and analyze hundreds of thousands of vulnerability attack vectors that we have collected over the years. During our update to strengthen security, particularly regarding attacks of the 'SQL injection' kind, a more complex system had been installed," said PKNIC executive chairman Ashar Nisar.
"However, it inadvertently left open a vulnerability, under certain obscure conditions and contexts, that was used in the recent attack. As a result, in addition to a thorough investigation of our entire site and systems, we reverted to the simpler more robust model of filtering out everything unknown, instead of continuing to use the new system that had been tailored to the latest threats using more complicated algorithms."
The firm said that it was not alone in being attacked, throwing up other examples of bigger name businesses that have also been breached recently, including Linkedin and Twitter, and Nasir said that its days of being vulnerable should be behind it. He added that the firm will soon launch a bug bounty program, which might encourage people to come to it with vulnerabilities first.
"We are confident of our website security, with the recent fix, and realize how important it is to remain vigilant against attacks," he added.
"Among new initiatives at PKNIC, we plan to invite friendly hackers to test drive the security of our systems. An announcement about a reward program for such developers and hackers will be announced shortly, as is done by leading global companies, like Google and others." µ