An Investigation Shows How Bomb Threat Scammers Hijacked Thousands of Big-Name Domains

Home / News

An Investigation Shows How Bomb Threat Scammers Hijacked Thousands of Big-Name Domains

By CircleID Reporter
January 24, 2019, 7:55 pm PST Views: 8,842 Add Comment

The threatening emails sent on December 13 caused mass evacuations, closures, and lockdowns in the US, Canada, and other countries around the world. The emails threatened to blow up buildings and schools unless recipients paid a $20,000 ransom. Ars Technica’s Dan Goodin reports that an “investigation shows the spam run worked by abusing a weakness at GoDaddy that allowed the scammers to hijack at least 78 domains belonging to Expedia, Mozilla, Yelp, and other legitimate people or organizations.”

Analysis of historical Internet records by Researcher Ronald Guilmette lead him to believe that the stolen domain names were *not* simply ones that some bad actor has put entirely fraudulent WHOIS data in for. Goodin writes: “After noticing that virtually all of the affected domains were receiving domain-resolution service from GoDaddy prior to being hijacked, Guilmette theorized that a system-wide vulnerability was somehow involved.”

Godaddy has since issued a response confirming that threat actor(s) abused our DNS setup process. “We’ve identified a fix and are taking corrective action immediately.”

NORDVPN DISCOUNT - CircleID x NordVPN
Get NordVPN [74% +3 extra months, from $2.99/month]

By CircleID Reporter — CircleID’s internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us.
Visit Page

Filed Under

Comments

The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.