Twitter outage via DNS hijacking

Published: 2009-12-18
Last Updated: 2009-12-18 08:37:38 UTC
by Stephen Hall (Version: 1)
5 comment(s)

A number of diary readers have submitted that the popular micro blogging site, has been defaced this morning.

The status page has the following report:

Update (11:28p): Twitter’s DNS records were temporarily compromised but have now been fixed. We are looking into the underlying cause and will update with more information soon.

If we receive any more information concerning the outage, or how the hijacking occured, we shall update the diary during the day. If you have any additional information, please let us know via the contact form.

Update: The following screen grab shows the DNS hijacking as recorded via the PassiveDNS systems. The host www . mowjcamp . org is currently hosting the defacement.

Steve Hall


Keywords: twitter
5 comment(s)


Here's an image courtesy of the folks at hackitall, although I'm quite certain it will be everywhere across the news by the morning. "Iranian Cyber Army" claiming responsibility in very broken English.
Just updated the diary to show what the results of the dns hijacking where.
What are the result of all this. Should I assume that the defacer now has my user credentials ? Or was it only the frontpage that was defaced ?

The IT security professional part of me screams "change password change password"
povlhp - neither, although you should always change your password ;) The DNS entries for twitter were changed to point at another site (mowjcamp) which hosted the defacement.
I've collected all the information which I could find "out there" in a blogpost:

One interesting thought experiment to perform is the following: what if the rogoue server would have responded to the TwitterAPI requests (especially the authentication requests)? How many people would have said to their twitter client: ignore the certificate error?

Diary Archives