Alneda.com stolen!

**mole** · 08-10-2002, 12:57 PM

Here's how the "pros" do it

From Wired
How Al-Qaida Site Was Hijacked

A Maryland hacker used simple Web tools like whois and traceroute -- as well as online translation software and an anti-cybersquatting service -- to take over the domain name of al-Qaida's website. And he's ready to do it again.

Jon Messner, the Internet entrepreneur who perpetrated the recent domain hijacking, used SnapName's Snapback service to obtain ownership of the domain www.alneda.com.

Since at least March 2001, al-Qaida has been using Al Neda ("The Call") as its official Internet headquarters.

The switch in ownership was made on July 16, as al-Qaida leaders were transferring its registration from a server farm in Malaysia to a new host in India.

"It was a slippery bastard, but I've got it now," Messner laughs. "I own alneda.com."

Al Neda contained editorials by major al-Qaida leaders, some of them explicit calls for action and justification of terrorist activities. There was a message board, containing relatively innocuous messages believed to be coded signals.

There was also a multimedia section containing pictures, audio files and videos of Osama bin Laden.

Earlier this year, Al Neda was being hosted on a server farm in Kuala Lumpur. Messner believes the United States government pressured the Malaysians to drop www.alneda.com from its site a few months ago.

When al-Qaida tried to move the domain, Messner struck. "After they pushed it out of the Malaysian registry but before it entered the Indian registry, in that split second the domain became exposed, and Snapback intercepted the transfer and put my info in there," Messner said.

The transfer went through successfully, only now Messner was listed as Al Neda's owner.

At that point, Messner put up a copy of the original al-Qaida website on his new domain, with one subtle difference. "I put very simple CGI tracking on the site, so for five days I could trace back to nearly every hostile Islamic message board and website on the Internet."

Messner used the Arabic translation software on Ajeeb.com to read the messages left on his new website.

"The context of the messages was all, 'Praise Allah, The Call is back online,'" Messner said.

For five days, visitors believed www.alneda.com was still the real al-Qaida site. Then at 4:30 a.m. on July 20, a message was posted to an Islamic message board by the person who had regularly maintained the actual Al Neda website.

"He told them it was a trap, not to go there, the infidels were tracking their information, they had taken control of the domain and stay away."

After that, Messner realized, "The jig was up."

With his cover blown, there was no sense keeping the decoy up anymore, so Messner replaced the website with a picture of the Great Seal of the United States and the phrase, "Hacked, tracked and now owned by the USA."

That same morning, Messner says, the real al-Qaida website appeared temporarily at www.news4arab.org, which has since gone down.

Messner hypothesizes that the next incarnation of al-Qaida's website will be on www.drasat.com

"Drasat.com is where all the videos on alneda.com were located," says Messner. "When Al Neda got shut down a few months ago, at one point the website appeared wholly on drasat.com."

The status of drasat.com seems to be in flux. Its DNS was changed Thursday night to point to two new servers, NS3.XAZDNS.COM and NS4.XAZDNS.COM, which are registered through Everyone's Internet of Houston.

Ali Al-Ali of Saudi Arabia is listed as the owner of drasat.com.

"To me, this activity indicates that they intend to put something on it," Messner said. "If I was to bet, that's where it would appear."

When Messner took control of alneda.com, he immediately contacted federal authorities. "The frustrating part was that it took me five days to actually talk to someone (in the FBI) who had a working knowledge of the Internet, and by that time the opportunity was gone.

"I had an exact duplicate of their site up. And they thought it was theirs."

Messner's motive? He said he made a decision after Sept. 11: "I was going to use every skill I had to screw up the terrorists' communication in any way I could."

FBI agents from the Baltimore field office eventually visited Messner's office but asked him not to disclose what they had discussed. FBI officials could not be reached for comment.

Messner has taken some precautions with his prize. "We've been rotating the website among different servers with a round-robin DNS, because they have been shooting it down pretty regularly," he said, laughing.

One slightly jarring note: A man identifying himself as Michalis Michael, calling from a number in Cyprus, left a message at Messner's office on July 23, claiming that he owned the alneda.com domain and demanding it back. Messner never returned the call.

"I didn't really want to talk to him," Messner said.

08-10-2002, 01:28 PM

the way that reads doesn't make sense - a registrar shouldn't delete a domain for a registrar transfer

**mole** · 08-10-2002, 01:31 PM

In case like this, safe, you don't want to know, you really don't want to know

08-10-2002, 02:17 PM

Are we supposed to be impressed?

Messner and SnapNames are criminals. No better than the ones he "claims" to be fighting.

**mole** · 08-10-2002, 02:19 PM

Originally posted by HippieChick
Are we supposed to be impressed?

No, you are suppose to laugh

shikes

08-10-2002, 02:33 PM

I don't see anything funny about stealing.

A crook is a crook. A crime is a crime.

Regardless of who it was done too.

**Brujah** · 08-10-2002, 02:52 PM

Ahhhh, all names that Snapnames gets are "stolen" and everyone that registered an expired name through them is a "hacker".

**Momentum** · 08-10-2002, 02:56 PM

Way to go Messner!

I really doubt it went down as described by the report. It seems like they jazzed up the story quite a bit to make it sound more like a "cloak and dagger" operation.

But who cares, you gotta love the results. I hope they gathered all kinds of new information and new leads for tracking down the terrorists.

08-10-2002, 02:57 PM

Originally posted by Brujah
Ahhhh, all names that Snapnames gets are "stolen" and everyone that registered an expired name through them is a "hacker".

What in the world are you talking about? Nobody ever said that.

This a specific thread about a specific case, where the crook and crime are documented and even advertised.

Please Brujah try to READ the messages before posting nonsense.

**mole** · 08-10-2002, 03:06 PM

Dang, another reincarnation.

**Momentum** · 08-10-2002, 03:11 PM

Yeah Brujah can't you read man!

Actually I thought it was a bad joke the first time I read the comment about snapping a domain name being no better than performing terrorist acts. But if this is true then somebody better tell Verisign before they unleash the bloody fury of WLS upon the world!

08-10-2002, 03:17 PM

Originally posted by Momentum
Yeah Brujah can't you read man!

Actually I thought it was a bad joke the first time I read the comment about snapping a domain name being no better than performing terrorist acts. But if this is true then somebody better tell Verisign before they unleash the bloody fury of WLS upon the world!

Nobody said that either. You people are real good at putting words in other people's mouths.

By the way, just because SOME people in a particular group or religion are bad doesn't make all of them bad. The women and children are mostly innocent.

If it's ok to attack one organization because of what a very small number of their members did, than who's to say that Baptists, Jews, or Catholics won't be next?

Men usually respond with their testes instead of their brains.

Typical.

**mole** · 08-10-2002, 03:19 PM

I beg to differ, Mom. Many dropped domain speculators hope to "snap" names from unsuspecting owners who lost track of the admin of their domains - in hope of a ransom "recovery fee" later on. When that happens, its JACKPOT!

**mole** · 08-10-2002, 03:25 PM

Originally posted by HippieChick

By the way, just because SOME people in a particular group or religion are bad doesn't make all of them bad. The women and children are mostly innocent.

If it's ok to attack one organization because of what a very small number of their members did, than who's to say that Baptists, Jews, or Catholics won't be next?

This is too contenscious an issue to handle on a humble domain name board. Suggest we keep to the vile techniques of domain hijacking

**fizz** · 08-10-2002, 03:33 PM

>>"...and an anti-cybersquatting service..."

So that's how the media perceives the SnapNames service?

**mole** · 08-10-2002, 03:39 PM

Hey fizz, what you doing up at this time of the night er.. morning?

08-10-2002, 03:45 PM

Originally posted by mole

This is too contenscious an issue to handle on a humble domain name board. Suggest we keep to the vile techniques of domain hijacking

hehehehe.

I agree.

**Momentum** · 08-10-2002, 03:52 PM

>>"...and an anti-cybersquatting service..."

Yeah, fizz, SnapNames comes out of this thing shining. Nice bit of PR work to put the right spin on this story.

True enough mole, I agree with you about the intention behind some of the snaps out there. But, I am just happy to see how one lone individual was able to use snapnames to hinder the terrorists.

**fizz** · 08-10-2002, 03:53 PM

Originally posted by mole
Hey fizz, what you doing up at this time of the night er.. morning?

LOL mole, I'm making sure SnapNames doesn't grab any of my names.

**fizz** · 08-10-2002, 03:58 PM

Originally posted by Momentum
>>"...and an anti-cybersquatting service..."
Yeah, fizz, SnapNames comes out of this thing shining. Nice bit of PR work to put the right spin on this story.

hehe. The new definition of a cyber-squatter is someone who owns a name that you really really want yourself.