KDMS Team, a group of Palestinian hacktivists, took over the URL of Metasploit with a spoofed DNS redirect fax.

This article is more than 6 years old

This article is more than 6 years old

A pro-Palestinian group of hackers calling themselves KDMS Team hacked the website of Metasploit, a leading net security firm, using a fax machine.

The hack was a simple DNS redirect, which involves an attacker changing the records which tell web browsers what server lies behind any given web address.

In this case, however, the redirect was carried out by faxing a faked redirect request to Register.com, Metasploit’s registrar.

“We are currently investigating the situation,” says Rapid7, Metasploit’s parent company, “but it looks like the domain was hijacked via a spoofed change request faxed to Register.com. We apologize for the service disruption, and do not anticipate any further implications for our users and customers at this time.”

It is the second major hack carried out by KDMS Team in the past week. On 8 October, the hackers performed a similar redirect on the websites of text messaging service WhatsApp, as well as security companies AVG and Avira.

Those firms were registered with a different registrar, Network Solutions, which fell prey to a fake password reset request, according to a statement from Avira.

Additionally, Bitdefender and ESET, two antivirus firms, were also hit with a DNS redirect. The method by which they were attacked remains unknown, but the sites are also registered with Register.com.

The hack redirected the domains to a page which contained a message from KDMS Team, reading in part:

You are one of our targets. Therefore we are here .. And there is another thing .. do you know Palestine ? There is a land called Palestine on the earth This land has been stolen by Zionist Do you know it ?

KDMS also took responsibility on its Twitter feed.

Kdms Team (@KdmsTeam) #bitdefender #eset Touched Long Live #Palestine

Following the hijack, another hacker known as Th3 J35t3r – “The Jester” – pointed out that KDMS’ twitter feed initially followed just 16 accounts, including many which had been dormant for years.

“Because of KDMS Team’s relatively new presence on Twitter, it is highly suspicious that it knows about, and follows, accounts that have not been active or tweeted for 6 months to over 3 years,” the Jester said.

Following that trail, the hacker claims to have identified the real people behind the KDMS team, and even identified the Facebook page of one member.

KDMS team no longer follows anyone on Twitter.

• How Turkish hackers took out the Daily Telegraph via DNS redirect