Almost a week after revelations surfaced that Lenovo preinstalled dangerous ad-injecting software on consumer laptops, attackers took complete control of the company's valuable Lenovo.com domain name, a coup that allowed them to intercept the PC maker's e-mail and impersonate its Web pages.
The hijacking was the result of someone compromising a Lenovo account at domain registrar Web Commerce Communications, and changing the IP address that gets called when people typed Lenovo.com into their Web browsers or e-mail applications. As a result, the legitimate Lenovo servers were bypassed and replaced with one that was controlled by the attackers. Marc Rogers, a principal security researcher at content delivery network CloudFlare, told Ars the new IP address pointed to a site hosted behind his company's name servers. CloudFlare has seized the customer's account, and at the time this post was being prepared, company engineers were working to help Lenovo restore normal e-mail and website operations.
"We took control as soon as we found out (minutes after it happened) and are now working with Lenovo to restore service," Rogers said. "All we saw was the domain come in to us, at which point we took immediate action to protect them and their service."
Rogers went on to say the unknown attackers posted MX mail server records that allowed them to read e-mail sent to Lenovo employees. The fraudulent records have since been removed. Rogers' account is consistent with an image posted by the LizardCircle Twitter account. The image showed an e-mail sent by an outside PR person to several people inside Lenovo's PR department.
The attackers "were hijacking e-mail up until we took control of the account," Rogers said. "At that point we removed their records and stopped it. I confirmed that when we took control [and] removed some bad MX (email) records. I don't think they were expecting us to step in and save the day for Lenovo as fast as we did, though."
Update: A little more than two hours after this article went live, Lenovo officials issued a statement that replaced a previously issued statement. It read:
Unfortunately, Lenovo has been the victim of a cyber attack. One effect of this attack was to redirect traffic from the Lenovo website. We are also actively investigating other aspects. We are responding and have already restored certain functionality to our public facing website.
We regret any inconvenience that our users may have if they are not able to access parts of our site at this time. We are actively reviewing our network security and will take appropriate steps to bolster our site and to protect the integrity of our users’ information and experience.
We are also working proactively with 3rd parties to address this attack and we will provide additional information as it becomes available.
People who visited the site during the attack saw a slide show that mainly featured a girl or young woman with dark hair sitting in what appeared to be a bedroom. When clicked, the images led to a Twitter account that sharply criticized Lenovo for preloading some of its computers with ad-injecting software that completely broke encrypted connections to HTTPS-protected websites. The software, provided by a company called Superfish, gave attackers an inexpensive and easy way to spoof Bank of America, Google, or any other website on the Internet and would nonetheless be trusted by most Web browsers.
An important point that's often lost in news coverage of domain name hijackings is that the attackers responsible don't actually compromise the servers of the targeted company. Rather, the attackers cause people trying to send e-mail or visit Web pages to bypass the targeted company's servers and instead access attacker-controlled servers, often with few indications to end users that there's anything amiss. That's not to say domain name hijacking can't cause severe security problems for the targets. In Wednesday's case, the attackers had complete control of the Lenovo.com domain, a feat that allowed them to not only intercept e-mail sent to Lenovo employees but also to easily spoof the account of any Lenovo.com address.
The interception of Lenovo e-mail is sure to catch the attention of law-enforcement officials. The attackers' use of CloudFlare may make it easier for their identities to be tracked down. Stay tuned. This story will no doubt continue to play out in the days ahead.
Listing image by Lenovo
reader comments
55