Verisign users hit in mass defacement

Domain name registrar Verisign, formerly Network Solutions, was left red faced yesterday after a large number of customer domains were vandalised in a mass defacement.

Although the defacement affected only 'parked' domains, undeveloped sites bearing the registrar's 'under construction' page, the hit may have affected thousands of customers.

Vandalised pages bore the recent digital graffiti attributable to the Web Pirates, a Brazilian defacement crew, along with the boast: "Did Web Pirates domain your domain? I think so." The defacement also listed a handy contact email and IRC channel for the group.

However, Web Pirates is denying the hit. The defacement is currently the main topic of conversation in the group's IRC chat room, but the only defacement it's laying claim to over the last few days is on a Linux-based Japanese site at overclocker.wakusei.ne.jp.

But the defacement group is not averse to hitting Windows boxes and the machine virtually hosting the vandalised domains was running Microsoft IIS. Interestingly, the attack also brought to light the fact that Verisign doesn't necessarily look after parked domains registered with it.

The affected domains had all been farmed out to another firm, Interland, under an outsourcing agreement. So, ultimately it was Interland which was actually at fault in the attack, not Verisign.

However, some customers may be a little put out to hear that a company the size of Verisign, which claims to have over 13 million domains under its belt, is farming the holding pages out to an insecure third party.

Interland has fixed the problem and is said to have involved the authorities in the investigation.