Digitalocean Domain Hijacking

Yes you heard it right.

Digitalocean domain hijacking. The above image is taken from here and was taken by steve jurvetson. Here we go in detail. When considering the 74 million domain names godaddy says it manages guilmette estimates godaddy s weakness left more than 553 000 domains vulnerable to hijacking.

Nextcloud a fork of owncloud is a file sharing server that permits you to store your personal content like documents and pictures in a centralized location much like dropbox the difference with nextcloud is that all of its features are open source. The domain resolved to the ip address 165 227 103 248 which geo locates to the united states and is hosted with digitalocean a legitimate cloud infrastructure provider headquartered in new york city. It is important that the fqdn in the ptr record has a corresponding and matching forward a record.

Going through each of those domains in passive dns we can find some oddities such as a domain w1 state security gov lb which during the attack time frame pointed to a linode address at 45 33 91 165 bdl gov lb pointing to a redcluster ip address at 185 205 210 23 which also holds an earlier gov eg domain hijacking or cdr gov. Domain hijacking is a well known security issue that can be carried in many different ways. Don t get panic i will help you understand about domain hijacking and tips to protect or get recovered from it.

Or an e mail provider or isp which went out of business or you stopped using them. In addition to social engineering or unauthorized access to the domain owner s account the exploitation of neglected dns records configured for cloud services is increasingly common. Lose being able to receive e mail on that domain lose your do account entirely you won t be able to even log in to change the e mail address.

A domain can be hijacked. However forcepoint threatseeker marked this domain as suspicious. Digitalocean will automatically assign the ptr record of any droplet when the droplet is named with a domain name.

It also returns the control and security of your sensitive data back to you thus eliminating the use of a third party cloud. To recover from the attack it is firstly important for you to understand the process of domain hijacking. Digitalocean seems to be getting a lot of flak from this post so i d just like to point out that i feel digitalocean s reaction in this case was entirely justified they saw an anomaly and they put a stop to it.