Domain Hijacking
Domain hijacking is a less frequently discussed but no less harmful attack on a company's or individual's Web presence. To establish a website, a domain name ("Companyabc.com") and a Web server (hosting service) must be procured. When a domain is hijacked, the attacker takes control of the domain registrar, a company that has been accredited by the Internet Corporation for Assigned Names and Numbers (ICANN) or a national country code top-level domain (TLD) account, to manipulate communication between the domain name and Web server. In effect, the attacker is interrupting the communication and redirecting traffic from one domain name server to another, using the new domain server for his/her own purposes. Once under new control, the criminal(s) can use the replicated name server (associated with the public-facing website) to send traffic to a new IP address and defraud visitors, interrupt private communications between the server and user, access visitors' account information (steal passwords/credentials), hold a domain hostage from the rightful owner, deface the website, interrupt service, serve up malware, or perpetrate pharming or phishing attacks. It is often extremely difficult to distinguish between the legitimate website and the coopted website.
Historically, registrars haven't offered robust security controls. CloudFlare, a security provider, recently announced a new service that protects its customers from domain hijacking since the problem has been prevalent. Most companies or individuals assume that high profile name servers are most at risk, but smaller name servers can serve as gateways to other controls.
To hijack a domain, an attacker needs to take management of the user's control panel. Through Whois/RDS, which is public record, any Web user can lookup domain ownership and, in many cases, the associated administrator's email address. Armed with this information, the attacker can use the email address as a backdoor into the domain name, brute force the password to the control panel, and reset the password, locking out the legitimate owner from his or her account.
