Brian Foy (brian d foy), a founder of the Perl Mongers organization, published a detailed analysis of the incident in which the domain perl.com was hijacked by outsiders. The domain takeover did not affect the project's server infrastructure and was executed at the level of ownership change and DNS server parameter replacement at the registrar. It is claimed that the computers responsible for the domain were also not compromised, and the attackers used social engineering methods to mislead the registrar Network Solutions and change the ownership data using fake documents to validate domain ownership.
Among the factors that contributed to the attack, the disabling of two-factor authentication in the registrar's interface and the use of a contact email pointing to the same are also mentioned. domainThe domain takeover occurred back in September 2020, in December the domain was transferred to the Chinese registrar BizCN, and in January it was handed over to the German registrar Key-Systems GmbH to cover up the tracks.
Until December, the domain remained with Network Solutions in accordance with ICANN requirements prohibiting the transfer of a domain to another registrar within 60 days after changing contact information. If the information about the domain hijacking had been disclosed before December, the process of recovering the domain would have been significantly simplified. Therefore, the attackers did not change the DNS servers for a long time, and the domain continued to operate without raising suspicion, which hindered the timely detection of the attack. The issue only came to light at the end of January when the fraudsters redirected traffic to their server and attempted to sell the domain on the Afternic site for $190,000.
Among the events related to the Perl language, it is also noteworthy that the CPAN module archive has stopped using mirrors in favor of employing a content delivery network to alleviate the load on the main. a szerverIn June, the plan is to completely clear the list of mirrors, leaving only one entry — www.cpan.org. The possibility of manually configuring the CPAN client to work through a specifically indicated mirror will remain.
Forrás: opennet.ru
