Domain hijacking or theft, can be defined as a security breach in which the hacker steals the target organization’s domain name and transfers its ownership to himself. Once successful, the hacker gains access to the control panel from where he points the domain name to another web server. Thus, whenever a user visits the website, he gets redirected to the hacker’s website. In most instances, the attack is carried out by falsifying a domain transfer authorization code or by using phishing techniques.

Given below are a few common methods that the hackers use for domain hijacking:

Spear Phishing

This is one of the easiest ways to steal the login details of the target website’s admin account. The hacker may send a fake email, claiming be to be from a genuine source, to extract information. The email may also contain a link that redirects the user to a phishing website that looks similar to the original one. When the user logs in to the admin account, the credentials are recorded by the hacker.

Domain Registrar Vulnerabilities

The hacker may also look for unidentified vulnerabilities in the domain name registration system. For instance, in the absence of any restriction on the number of invalid login attempts, the hacker may initiate a brute force attack. Through this, he may employ the trial and error method to use multiple password combinations till the login is successful.

Web Server Vulnerabilities

Security flaws in the target organization’s web server can also be exploited to gain access to the website admin account credentials. In the absence of proper security measures, there are high chances that vulnerabilities in the hosting server provide a backdoor for the hacker to gain access to your website.

Tips To Prevent Domain Hijacking

• Use Two Factor Authentication: Many domain registrars provide an additional security layer to the users by allowing two factor authentication. With this, each time you log in to the admin account, you will have to enter your user name and password, along with a numeric code sent through a text message.
• Request DNSSEC From Your Domain Registrar: Domain Name System Security Extensions (DNSSEC) is a technology that can prevent a domain hijacking attack. It allows the website admin to monitor traffic and use digital signatures to verify the legitimacy of the DNS responses.
• Change Default Password: Make sure you change the default password of your admin account. If you retain the same login credentials provided by your registrar, your domain security may be at risk.

For more information about domain hijacking, contact Centex Technologies at (972) 375 – 9654.

Mobile security is one of the top priorities for business organizations. With the increasing adoption of Bring Your Own Device (BYOD) culture, it becomes even more important that employees are familiar with the best security practices to safeguard the information they access or share through their device. However, there are many misconceptions when it comes to mobile security, which ultimately makes your corporate data vulnerable to hacking.

Given below are some of the common mobile security myths and why they need to be addressed cautiously:

iPhones are safe from viruses

It is a common fallacy that Apple devices are completely protected against viruses and malware but this is not completely true. Though Apple’s stringent policies minimize the threat to some extent, there is still need for proper security measures to ensure safety of your device. Malicious websites, spam links, fake websites and malware ridden email attachments pose a serious threat to your data.

It is safe to connect Wi-Fi if sensitive data is not accessed

Mobile users are familiar with the fact that conducting financial transactions and logging into personal accounts through open Wi-Fi networks is not safe. However, even if you are not accessing any sensitive information, connecting to an unsecure Wi-Fi hotspot can jeopardize your online security. Hackers may use packet sniffers to steal or modify the information you share. They may also infect your device with a malware and record keystrokes to collect your usernames as well as passwords, which may lead to identity theft.

Mobile apps from reliable vendors are safe

Renowned developers conduct extensive testing to ensure that the apps they release are secure and bug free. However, there are many fake and malicious versions of the popular applications available on the app stores. You should know which apps you should download and from where. The best way to check this is to read reviews posted by users who have already downloaded the app. You should also be careful while allowing any app to access your personal information.

Text messages are completely secure

In reality, text messages are one of the major vectors of malware to mobile devices. Hackers use phishing techniques by sending messages that claim to be from a bank or other legitimate source to extract sensitive information from the target user. SMSs may also contain links to a fake website that may download a malware to your mobile device.

Centex Technologies, a leading IT company in Dallas, TX, can help you improve mobile security practices in your organization. For more information, you can call us at (972) 375 – 9654.