HD Moore gets owned

newsguy 0 254 Views

I guess you could call it karma. HD Moore's company, BreakingPoint, found that traffic was being diverted to a scammer Google page. This kind of cache poisoning attack on DNS servers is not unusual, however this particular case was because HD Moore is the man who created the Metasploit hacking toolkit. What's more this kind of poisoning was recently made a lot easier than it used to be, in no small measure thanks to the HD Moore Metasploit project being the first to release software that exploits the new technological method for doing so.

According to PC Advisor it would seem that HD Moore himself was not the target of this attack, however, just an unfortunately high profile and somewhat ironic victim. The attack was actually against an AT&T network in Austin, Texas which served BreakingPoint.

When AT&T got owned so did HD Moore.

It was only a matter of luck that the hack was spotted. When HD Moore went to visit google.com he was redirected to the scammer pages which were a direct clone of the Google site. Apart from the fact that the hacker forgot to use the NASA themed logo that Google had been using that particular day...

Dani AI

Generated

Concise clarification and practical advice based on the thread: correctly noted the visible symptom — web traffic being redirected to a scam page — and correctly pointed out that HD Moore later disputed being “owned” in the sense of a system breach. The observable problem was cache-poisoned DNS responses on the path between users and their recursive resolver, not necessarily a direct compromise of BreakingPoint hosts. Treat redirection symptoms as an infrastructure/authentication issue first, and a host compromise only after evidence confirms it.

How cache poisoning works (brief): recursive resolvers accept the first matching DNS reply that fits the query ID and source-port tuple. Attackers flood forged replies hoping one matches before the legit response arrives. Defenses are about increasing entropy and verifying authenticity, not just finger-pointing.

Practical mitigations and checks to apply now:

  • Patch DNS software and OS kernel regularly.
  • Ensure source-port and transaction-ID randomization are enabled in resolvers.
  • Deploy DNSSEC validation on recursive resolvers (or use validated upstream resolvers).
  • Use 0x20 (mixed-case) query encoding where supported for extra entropy.
  • Log DNS answers and alert on unexpected authoritative changes or unusually low TTLs.
  • For users, prefer resolvers that perform validation and keep browsers/HTTPS/HSTS and certificate checks up to date.

Quick checks to run (examples):

# Query a specific resolver and compare answers
dig @<resolver-ip> example.com +norecurse +noall +answer

# Compare against public/other resolvers
dig @8.8.8.8 example.com +short
dig @1.1.1.1 example.com +short

# Watch DNS traffic if you manage the resolver/network
sudo tcpdump -n -i any udp port 53

If answers differ across resolvers or TTLs/A records change unexpectedly, suspect poisoning: switch clients to a trusted resolver, flush caches you control, notify the ISP/operator, and collect logs for forensic review.

Member Avatar for happygeek
happygeek 2,411 Most Valuable Poster

Looks like the PC Advisor story, using an IDG interview, was not 100 percent accurate in as far as the HD Moore owned quote is concerned at any rate. The Inquirer () has a piece about HD Moore himself saying he was misquoted, and never said he was owned like the IDG writer stated.

That said, the basis of the story seems sound, it's just that HD Moore wants to make it clear that "Stating that my company was "compromised" leads the reader to believe that there was some sort of security breach, which is reinforced by the fabricated quote."

So there you have it, HD Moore did not get owned and he was joking when he said he did. And while no BreakingPoint computer was actually compromised by the attack on AT&T, it was still a victim.

Pretty much like we have said in our coverage of the story here, in fact.

Davey wearing his Blog Editor hat...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview