SAN FRANCISCO — A vulnerability in the Internet’s design is allowing criminals to silently redirect traffic to evil double websites under their control. The problem is being fixed, but its extent remains unknown and many people are still at risk.
“It’s kind of like saying, ‘There’s a bunch of money on the street. If you can get over there soon enough, you can get it,’ ” said Ken Silva, chief technology officer for VeriSign, which manages the “.com” and “.net” directories of Internet addresses.
Since the hole’s existence was revealed nearly a month ago, criminals have pulled off at least one successful attack, directing AT&T Internet customers in Texas to a fake Google site.
A researcher found that by adding bad information to the packets of data zooming in and out of certain DNS servers, hackers can swap out the address of a legitimate website and insert the address of their malicious site instead. A compromised server believes it’s sending people to the authentic site. And if the bogus site is designed well enough, users don’t know the difference.
“This is the mother lode, all right,” said Paul Vixie, president of the Internet Systems Consortium, “from the point of view of Internet criminals looking for easier access to other people’s money and secrets.” The Associated Press
