Here's how bitcoin's $7.9 billion April options expiry impact prices
Bitcoin's $7.9 billion options expiry could lead to price volatility around $62k and $75k.
CoinDesk1 min read
Hackers impersonated eth.limo team to hijack its domain: Post-mortem
TL;DR
The eth.limo domain was hijacked due to a social engineering attack on EasyDNS, its domain provider. An attacker impersonated a team member to gain access and alter domain settings, prompting warnings from Ethereum co-founder Vitalik Buterin.
Key points
- Eth.limo domain hijacked due to social engineering attack
- Attacker impersonated team member to access EasyDNS account
- Domain settings altered to redirect to Cloudflare
- Vitalik Buterin warned users about potential risks
- EasyDNS CEO accepted responsibility for the incident
Mentioned in this story
eth.limoEasyDNSVitalik Buterin
Ethereum Name Service gateway eth.limo has revealed that the domain hijacking on Friday was caused by a social engineering attack directed against EasyDNS, its domain name service provider.
According to a postmortem published by eth.limo on Saturday, an attacker impersonated one of its team members to initiate an account recovery process with easyDNS, granting access to the eth.limo account and allowing them to alter domain settings.
“The NS records were changed and directed to Cloudflare… Once we understood that a DNS hijack had taken place, we immediately notified the community as well as Vitalik Buterin and others. We then began contacting EasyDNS in an attempt to respond to the incident,” the company said.
Eth.limo serves as a Web2 bridge, providing access to around 2 million decentralized websites using the .eth domain name. Hijacking the service could allow an attacker to redirect users to malicious websites. Ethereum co-founder Vitalik Buterin warned users Friday to avoid his blog until the incident was resolved.
Mark Jeftovic, CEO of easyDNS, has publicly accepted responsibility for the incident in its own postmortem report.
“We screwed up and we own it,” said Jeftovic on Saturday.
“This would mark the first successful social engineering attack against an easyDNS client in our 28-year history. There have been countless attempts.”
Both companies have pointed to the Domain Name System Security Extension (DNSSEC) in thwarting the hacker’s attempts to do further damage.
The attacker couldn’t produce valid cryptographic signatures, so Domain Name System resolvers rejected the attacker’s forged DNS responses, causing users to see error messages instead of being redirected to malicious sites.
“DNSSEC was enabled for their domain when the attackers attempted to flip their nameservers, presumably to effect some manner of phishing or malware injection attack, DNSSEC-aware resolvers, which most are these days, began dropping queries,” Jeftovic said.
Q&A
How did the eth.limo domain hijacking occur?
The hijacking occurred through a social engineering attack against EasyDNS, where an attacker impersonated a team member to initiate an account recovery process.
What actions did eth.limo take after the domain hijacking?
Eth.limo notified the community and Vitalik Buterin, and began contacting EasyDNS to respond to the incident.
What are the implications of the eth.limo domain hijacking?
The hijacking could allow attackers to redirect users to malicious websites, compromising access to around 2 million decentralized sites using the .eth domain.
Who is responsible for the eth.limo domain hijacking incident?
Mark Jeftovic, CEO of EasyDNS, publicly accepted responsibility for the incident in a postmortem report.
