A group of Palestinian hackers, also known as the KDSM Team, has managed to deface several high-profile websites, including AVG, Avira, and WhatsApp. According to Avira representatives, it was not the websites themselves that were compromised, but their DNS settings.
"We have found that several Avira domains, as well as websites of other companies, were attacked by a group called KDMS. Avira websites have not been compromised, as the attack was carried out through the internet service provider, "Network Solutions," Sorin Mustaca said in a statement yesterday.
According to Mustaca, the DNS records of the affected websites had been modified, redirecting traffic from these sites to arbitrary domains.
The attackers appear to have submitted a request to Network Solutions to reset the password of the Avira account, which was created to manage DNS records.
“Network Solutions appears to have accepted the request and allowed the attackers to take control of our DNS. Using the new credentials, the cybercriminals were able to change the entries to point to their own DNS servers.”
Avira confirmed to customers that its internal networks have not been compromised.
