Hello, welcome to the Friday, January 6th, 2017 edition of the Sandcent, Stormcent, Stormcast. My name is

Johannes Ulrich, and today I'm recording from Jacksonville, Florida. Earlier this week, the registra

that is hosting Google's Brazilian domain, Google.com.com.B.R. apparently was compromised, and Google's Brazilian domain, Google.com.B.R apparently was compromised and Google's name

servers were pointed to a different destination. With that, the attacker, of course, had full

control over all Google.com.com.B.R. DNS entries, MX records, and the like, and could change them at will.

Now, they also changed the TTL, the time to live, to 24 hours. So if during the half hour window,

when the malicious DNS servers were active, you requested an IP address from that domain, You would then cash it for a full day before

it would expire and you would only then look up the correct IP address after Google fixed the

problem. This does keep happening to some of Google's foreign properties we had, I think, two years ago.

The Malaysian domain was, if I remember correctly, at least compromised twice.

All of this is not really within the control of Google, because for some of these country-level

domains, actually other companies are running the name servers,

and with that, of course, they don't really have any effect on how those name servers of the

registrars that are hosting these country level domains are managed.

Now, Renato Marino did create a real crate right up about this particular issue

with lots of details like the IP address and such that were involved in this particular attack.

He himself resides in Brazil so he had sort of a first person view of this particular event.

As far as everybody else's domain goes, you really

have to monitor your domains, make sure they're not being altered. This was sort of the most

obvious change in Hacker could make. We have seen, of course, in the past, when NetHacker would,

for example, just change MX records or add

additional host names in order to use them in targeted fishing attacks.

...