Lieberman Site Probably Not Hacked

Wednesday, August 09 2006 @ 04:12 AM EDT

Edited by: Michael Hess

Website Nameservers Could Have Been Pointed to an Alternate and have been Back Up Immediately

BBSNews 2006-08-09 -- It should have been trivial. If the Website goes down for whatever reason, a prudent Web Administrator would simply move the domain to another server. This could have been at the original provider, in this case The Planet, who merged with EV1 on May 8th, 2006.

President George W. Bush talks with Senators Bill Frist, R-Tenn., right and Joe Lieberman, D-Conn., during the signing ceremony of S. 2845, The Intelligence Reform and Terrorism Prevention Act of 2004, in Washington, D.C., Dec. 17, 2004.
President George W. Bush talks with Senators Bill Frist, R-Tenn., right and Joe Lieberman, D-Conn., during the signing ceremony of S. 2845, The Intelligence Reform and Terrorism Prevention Act of 2004, in Washington, D.C., Dec. 17, 2004.

Image Credit: White House photo by Paul Morse.

It would have taken the root domain name servers (DNS), the internet phone books that match IP addresses with domain names, just hours to start propagating the correct name resolution; in reality every blogger and most fifteen year-olds could have put that Joe Lieberman's Web site back up on GoDaddy or any number of other Web hosts and have it 'resolving' or showing up in your Web browser in minutes. When you type in a Web site name, the root DNS servers that form the directory information of the world internet look through their records and when they find the record that ties an IP address to a domain name, they refer you to it and there you are.

Most people do not think too much about how Web site Internic registration comes first, and then Web site hosting, comes next. They are two different elements that make a Web presence. A helpful way to think about it is as your name and your phone number. Your name never changes, unless you get married or decide to name yourself something other than the name on your original birth certificate. But your phone number has probably changed since you first gave out your parents phone number or if you were born into some money, the special phone number your parents provided for you. You will likely have at least several phone numbers throughout a lifetime. Your phone company is your name server. DNS means simply domain name server[s]. They are the internet phone book that directs a 'caller', a Web site browser, to the correct domain name.

Those that really want to maintain a named Web presence keep up their registrations and these days this occurs at a very trivial cost, less than ten bucks American per year.

Web hosting is quite different. Just like someone would likely change telephone providers throughout their life so would someone who is growing a Web site.

In this case, the domain joe2006.com is not set to expire until May 13th, 2007. So it's not the domain registration that is reflecting a problem. It is a breakdown in whoever administers the site and their ability to keep a Web site up. I'll give up a useful secret about Web administration right here. Take the snapshot. Get a complete copy of the possibly "hacked" Web site, then put it back up.

Don't tell anyone you have been hacked if that turns out to be true. Then you wind up having to answer questions about what exploit was used. This over time gives a profile of how you approach your Web site security. Don't give anyone this information except for the most trusted people in your organization.

But put the site back up without delay, with much dispatch, and make the outage a personal challenge and get the site back up before Google makes the next GoogleBot pass.

This is how you stay alive in the internet world.

If you have a Web site you consider important such a political campaign site, back it up. Then when something like this happens, that does not look like a hacking problem but more of an admin problem, you can simply put your site back up and point to different name servers (same number, different phone company).

Ping results from the joe2006.com Website reveal:

Pinging joe2006.com [69.56.129.130] with 32 bytes of data:

Reply from 69.56.129.130: bytes=32 time=48ms TTL=45
Reply from 69.56.129.130: bytes=32 time=47ms TTL=45
Reply from 69.56.129.130: bytes=32 time=48ms TTL=45
Reply from 69.56.129.130: bytes=32 time=47ms TTL=45

Ping statistics for 69.56.129.130: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 47ms, Maximum = 48ms, Average = 47ms

When we ping BBSNews we get the same time to latency (TTL) but the Lieberman site is getting much better performance on the time in milliseconds. What this means is that joe2006.com is indeed up and its vital signs are quite healthy but the doctor, the Web master, is apparently golfing like it's already Wednesday afternoon.

This Web site should have been right back up, within about an hour. This is simply a standard in an enterprise situation and it should have been standard in this Lieberman campaign that for a while claimed they had been hacked. By now, surely they know better.

###

Comments (0)


BBSNews
http://bbsnews.net/article.php/20060809041204323