Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have quite serious case here.

One day, My company missed to extend a domain name by few days. So it went to grace period. From what I know, if it went to grace period, people still able to access my website. However, the site was actually showing a porn site with domain name header. My boss quickly paid the domain names and few minutes after that the website is back. This creates catastrophic situation between company and users and I should be able to explain this to the users.

After days of research, I'm unable to find what in the world is the site was showing a porn site.

So here is my conclusion so far:

The developer used openx v2.8.8 to show ads, maybe some one has hacked using xss or csrf attack. I have the picture below to show the screenshot.

screenshot

The URL is still connected to our domain but with subdomain of OPENX.

My question here:

  1. is the site was hacked?

  2. if it is hacked, i need to know how it can be hacked?

If you need more information could you please put a comment below. I appreciate for any help. Thanks

ps. Sorry, I can't disclose the site name for the sake of security.

share|improve this question
    
So was the site only redirecting during the period that your DNS hadn't been paid up? One thing to note is that OpenX had a recently discovered backdoor in their code which has active exploits. exploit-db.com/exploits/27529 –  Rоry McCune Aug 16 '13 at 8:50
    
Yes, after paid up it seems back to normal.Is that affect 2.8.8 as well, @RoryMcCune? –  William Calvin Aug 16 '13 at 9:09
    
not sure actually, may only be 2.8.10. However if the change went away when the DNS was paid up, it would seem unlikely to be that. Sounds like something you should take up with your DNS provider.... –  Rоry McCune Aug 16 '13 at 9:29
    
Yup. already asked them and waiting for their response. Thanks @RoryMcCune –  William Calvin Aug 16 '13 at 10:01
1  
So when you stopped paying for your domain, they turned your site into porn? That's the funniest thing I've heard all week. Also, you really ought to have bought that domain from a real ICANN accredited vendor. –  tylerl Aug 16 '13 at 17:05

1 Answer 1

While multiple vulnerabilities exist in OpenX, there just isn't enough information in this case to tell for certain if your site was hacked or not.

It appears from what you said that the company from whom you bought your domain simply redirected your DNS records to a porn server after you stopped paying. And then when you paid again, they redirected you back. That would indicate that your original site and server was not actually affected at all.

share|improve this answer
2  
But it means that your DNS is hosted by a crappy company which is almost as bad. –  CodesInChaos Aug 16 '13 at 17:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.