Craigslist back up and running after DNS hijack

library
crime | hacking | security

If you had trouble getting onto Craigslist to sell your apple green velvet armchair over the weekend, join the club: the site was hijacked on Sunday night.

Craigslist chief executive Jim Buckmaster confirmed in a blog posting that the classified-ads site was attacked at about 5pm PST Sunday evening.

Buckmaster said that the Craigslist domain name service (DNS) records maintained at one of its domain registrars were compromised, diverting users to various non-Craigslist sites.

One of those sites was an online forum called Digital Gangster (not to be confused with The Digital Gangster, which is a site for marketers).

Digital Gangster was down when I checked on Monday afternoon, perhaps due to an inability to handle the heavy traffic load somebody/it inflicted on the site/itself by hijacking the immensely popular Craigslist site.

According to Craigslist, it gets 50 billion page views per month.

Digital Gangster has a colorful history: a member of the online forum claimed to have been behind a 2009 attack on Twitter that resulted in break-ins and exfiltrated messages from 33 Twitter accounts, including those of celebrities Bill O’Reilly, Britney Spears and CNN’s Rick Sanchez.

The forum was also where an attacker reportedly posted photos stolen from Miley Cyrus’s Gmail account in 2008.

Craigslist says it’s now fixed the problem, but because DNS entries are often set up to be cached for several hours some people might still be getting the bogus entries.

Buckmaster said that people who are still unable to reach the Craigslist site should please ask their network provider or tech staff to flush all .craigslist.org and .craigslist.com entries (A,CNAME,SOA) from their DNS servers.