TCS Hacked!!!!!!!!!!!

Not Really, But ...

TechCrunch.com had a post up sometime last night claiming that India's largest software company Tata Consultancy Services' website, www.tcs.com had been 'hacked'. The update to the post confirms that only some users are seeing the compromised version of the home page ie. this is a classic DNS hack and only certain name servers seem to be affected. The WHOIS page for TCS lists the following nameservers:

Domain servers in listed order:

NS1.TRACOM.NET 216.15.130.71

NS2.TRACOM.NET 216.15.130.72

NS3.TCS.COM 203.101.69.159

NS4.TCS.COM 219.64.33.98

NS5.TCS.COM 208.44.114.53

A domain name server is basically a centralized online directory/database which keeps a list of IP addresses corresponding to the domain names that we type into our browser. If it's compromised, typing in a URL could take you to a completely different site as intended by the hacker, often (though not in this case) with dangerous consequences. When twitter.com recently fell victim to such an attack, the perpetrators could have got access to twitter usernames and passwords if they'd put up a fake login page so that users would think they were entering the information into twitter.com as usual. Luckily it was just a political statement by Iranian hackers.

In this case it seems likely that one (or both) of TCS' website registrar ie. Network Solution International's name servers has been compromised though we're still awaiting an update from TCS on whether any of theirs were tampered with too. If TCS is to blame at all here, it should be for poor housekeeping. I mean, which large company, especially in tech, lists third parties (honeybeetechnology.com  doesn't even look legit??!!) as its "administrative & technical contacts" on the WHOIS page? Certainly not TCS' competitors! See Infy's WHOIS page here and Wipro's here.

Nevertheless this is going to be a bit of a headache for the TCS PR team, especially since publications like the Washington Post syndicate TechCrunch content, lending the news an air of credibility in the Indian company's primary market. Also, one can always bank on a few idiots to give a racist slant to this news. Luckily, one of them on TechCrunch got a great retort

 

Tata Consultancy Services official website www.tcs.com has been attacked and hacked. The hacker has left a message suggesting the website is up for sale.

At the time of writing of this post if you visited the official url of TCS, www.tcs.com; this is message you are greeted with.

Strangely the hacker has put up a email Id out there in case someone is interested in buying the domain.

It is probably unrelated but there has been a rise in official websites being hacked into with messages. This is known as defacing homepages. Only recently Indian government had admitted that China based hackers had attacked official computers. But those were more sophisticated and meant to attack computer systems rather than deface any websites.

DNS Attack?

It seems TCS is facing DNS attack of some kind as the homepage opens fine with Pagewash. Here is a video to explain.