Hackers hijack entire Web

Seeking to make money from mistyped website names, some of the United States' largest ISPs are instead creating gaping security holes in the web's largest websites, including eBay, PayPal, Google and Yahoo.

The ISPs are making it possible for hackers to turn any website into a source of viruses, phishing attacks and other malware.

The massive vulnerability introduced by Earthlink and Comcast was quietly and quickly patched on Friday, after IOActive security researcher Dan Kaminsky reported the vulnerability to Earthlink and its technology partner, a British ad company called Barefruit.

"The entire security of the internet is now dependent on some random-ass server run by some British company," Kaminsky said.

Starting in August 2006, Earthlink changed how it handled the process of turning requests for a domain name such as Youtube.com into the numeric IP address of the site's server, hiring Barefruit to help it make money from this system.

The news of the massive security breach created by ISPs subverting internet protocol for profit comes just two days after the Federal Communication Commission held a hand-wringing public forum at Stanford University over whether it should punish Comcast its violation of a standard internet practices by sending fake packets to its users in order to reduce the amount of bandwidth peer-to-peer applications use.

Kaminsky is demoing the hole publicly on Saturday at the Toorcon security conference in Seattle.

Kaminsky, a well-respected security expert, is perhaps best known for cleverly proving that a spyware rootkit Sony included on music CDs infected computers in more than half a million computer networks in 2005.

The hole was made possible by ISPs subverting the Domain Name System or DNS, which translates website names into numeric addresses.

When users visit a website like Wired.com, the DNS system translates the domain name into an IP address such as http://72.246.49.48. But if a particular site does not exist, the DNS server tells the browser that there's no such listing and a simple error message should be displayed.

But using Barefruit's technology, Earthlink instead intercepts that Non-Existent Domain (NXDOMAIN) response and sends the IP address of Barefruit's ad server as the answer. When the browser visits that page, the user sees a list of suggestions for what site the user might have actually wanted, along with a search box and Yahoo ads.

The rub comes when a user is asking for a nonexistent subdomain of a real website, such as http://webmale.google.com, where the subdomain webmale doesn't exist (unlike, say, mail in mail.google.com). In this case, the Earthlink/Barefruit ads appear in the browser and the title bar indicates that it's the official Google site.