Cyberattacks against companies, organizations, and agencies have multiplied at a chilling pace, but this time the operation targeted one of the pillars of the Internet. As we know well, ICANN is responsible for administering and assigning names, domains, and IP numbers on the network of networks. Last Tuesday, the organization confirmed that part of its data was compromised due to an attack that began last November.
We all agree that any kind of cyberattack is negative, however, we have also noticed among the affected companies a worrying lack of dedication when it comes to defending their infrastructure. Without going further, the hack of Sony Pictures revealed folders with plain-text files that stored passwords. Some names in the market, especially those that are unofficially considered “targets” by hackers, should pay a little more attention instead of calling for authorities once the damage is done. Who got it this time? The news takes us to ICANN, the organization that basically controls all the threads regarding names, domains, and IP addresses.
The attack
Through an official statement published last Tuesday, ICANN confirmed that it was the victim of an attack based on the spear phishing technique, initiated during the final days of November. In other words, the organization's employees fell for the deception and sent their credentials via email, because the attackers used an address that apparently had ICANN's domain. The compromised credentials enabled unauthorized access to resources such as the Centralized Zone Data Service, the GAC wiki space, the official ICANN blog, and the WHOIS information portal.
By far, the hardest blow was received by the Centralized Zone Data Service, since details such as real names, physical addresses, emails, phones, and usernames were leaked. Passwords had been encrypted, but ICANN decided to force the renewal of all of them as a precaution.
Honestly, it seems incredible that anyone still falls for the old trick of “we lost the database, we need your username and password,” but if we think more carefully, the truth is that the attacker only needs one credential from an angry, tired, sleepless, sick, or too busy employee.
