Google.com.pk and 284 Other .PK Domains Hacked

By Aamir Attaa | 24, Nov 2012 | 99 Comments

Start page for majority of Pakistanis – when they first visited it this morning – was found hacked and defaced. Yes, Google.Com.PK along with 284 other .PK domains were hacked today (and are still defaced).

According to Irfan Ahmed, an expert on Pakistani websites and web-servers, this defacement is due to change in DNS entries for 284 .PK domains that are managed by MarkMoniter.

Defaced domains include Microsoft.PK, apple.PK, paypal.PK, ebay.PK, blogspot.PK, chrome.PK, Cisco.PK and others.

Apparently no one has claimed the responsibility for the incident, but a message appearing on defaced pages, including on Google.com.pk is displaying a message in Turkish language, hinting that the hacker could be Turkish in origin.

Hacker hasn’t left any message for anyone, unlike the norm that hackers follow to convey their message through such defacements.

However, there is a phrase saying “Downed Pakistan”, a sign of victory for hackers when the deface a website.

Check below the screenshot of hacked Google.com.pk – which is still in-tact for few users.

Muhammad Ahmed

Working perfect
- waqar
  
  not working…
  - http://ptetech.blogspot.com/ Mahfooz Ahmad
    
    is it still down at your side
اظہر علی

haha
http://ptetech.blogspot.com/ Mahfooz Ahmad

working fine at the moment
- http://www.facebook.com/bilal.iqbal.775 Bilal Iqbal
  
  where working…
  using main page of google.com instead .pk domain
- Waqas
  
  Strange. Still down for me
  - http://ptetech.blogspot.com/ Mahfooz Ahmad
    
    lol! that means its ISP based hacking
    - Waqas
      
      I am on wi-tribe. Your ISP?
      - http://ptetech.blogspot.com/ Mahfooz Ahmad
        
        Wateen
        
        http://www.facebook.com/profile.php?id=1137377371 Asad Ali
        
        still not working :(( who the hell hacked !
        
        http://ptetech.blogspot.com/ Mahfooz Ahmad
        
        when i checked in the morning it was working fine but now its not!
      - http://www.facebook.com/profile.php?id=1176984930 Jawad Hussain
        
        nopsss…. some people have http://www.google.com as homepage, whereas http://www.google.com.pk is hacked and is still out of function :D
    - aslamweb
      
      its not isp based hacking .. its http and https based hacking .. HTTPS is working Well :) http://google.com.pk is hacked .. https://www.google.com is working well :)
    - aslamweb
      
      this one http://www.google.com.pk/ is onliy hacked .. not https ;
http://twitter.com/pomy Pomy Mughal

Seems Turkish hacker Mr. eboz got access to the PKNIC account for changing Nameservers ~ http://goo.gl/yREkq

- It’s not their fault (Google) this breach happened from our side (PKNIC) – Google is still down from my side since last 3 hours. It’s 10:02 AM – I’m using PTCL Broadband.
JAHIL

take a look here http://www.zone-h.com/mirror/id/18639746
JAHIL

whole .PK registry is poisoned
- http://ptetech.blogspot.com/ Mahfooz Ahmad
  
  you are right!
- Guest
  
  A lot of experts sitting here and i want to share some thing too.
  
  Its not google that has been hacked. Possibly our TLD (top Level Domain) i.e pknic has been compromised and the name server entries were changed . The websites are re-routed not hacked. This was the same thing happened to supreme court website couple of moths back so it seems that there is some security hole that is not covered by pknic.We should blame pknic not google, but at the end of the day security is not 100% possible.
Umar

Cannot be the work of any Turkish. It is some Indian or Israeli who is using Turkish Language just to create confusion.
- Salman Abbas
  
  ROFL konse molvi ko sunke aye ho. grow up.
  - Khawaja
    
    I agree with Umar Looks like a work of a non-Turkish. I’ve been to Turkey personally, Turkish people treat us Pakistanis in the best possible way in today’s era. Turkey is one country that stands by us and helps us. Turkish language has been used to create confusion, confusion among the Turkish and Paki people :).
    
    One of the most simple ways.
    - Salman Abbas
      
      I hereby nominate you for the “Worst Conspiracy Theory of 2012″ award.
      - moxet
        
        Who the hell you are to announce the award. Its by indian or Israilis.. Grow UP
    - http://www.facebook.com/faiyaz.hussein Faiyaz Hussain
      
      hackers are few in millions dude…and are jerks [most of the time]. and turkey being a hospitable nation doesn’t make few jerks the angels.
  - http://www.facebook.com/faiyaz.hussein Faiyaz Hussain
    
    and why is that you’re so sure of the man behind this being a turkish…it’s just a sentence written in turkey. that doesn’t NECESSARILY make him turkish. grow up you too
  - usama
    
    grow up buddy :)
    most possible way using google translator :) i knw trukhs hacker they show weakness not pak downed
- Karkum
  
  LOL he is the hacker http://www.dl4hacks.net/user-4952.html
  
  ye ap ko kaha se Israeli or Indian lagta hai?
  - Guest
    
    Registration Date: 09-23-2012
  - http://aaqil.co.uk/ Aaqil Mahmood
    
    Registration Date: 09-23-2012 hmm
- http://www.facebook.com/boomzday Saqib Mansoor
  
  There is one born every minute.
- http://slickzine.com/ Slickzine
  
  Aise pagal moulvi hamarey mulk ko le dubein ge. Turkish tere mamey ke putar hein ? Theka nhi uthaya hua unhon ne hamari terha dunya ka
- http://www.itemspecs.com/ jawad zaib
  
  totally agree with you Israelis did this because a few days earlier Pakistani did the same to Israeli sites…this is the counter attack…
  - http://www.facebook.com/faiyaz.hussein Faiyaz Hussain
    
    yes…you’re making some sense here
  - Asad
    
    Agreed, this is a counter attack………
- http://www.pakblogger.net/ Abdullah
  
  I agree with you. There’s no such dispute between Pakistan and Turkey. Why should Turkish people do this.
  
  As far as it is about profile nd message in Turkish Language. It can be fake.
  
  Complete List of Hacked .PK Domains
  
  How Google.com.pk and other .PK Domains were Hacked
- PAKbugs
  
  No this is down by Turkish. Eboz is Turkish hacker. Don’t worry you will see more Israel defacements soon. ;)
anonymous

opening
anonymous

someone using evo? having any trouble with this today? disconnecting every 2 minute from 7a.m today
- Hassan Salman Saeed
  
  bhai ptcl tu eisa he haii… witribe is the best
- http://www.facebook.com/bilal.iqbal.775 Bilal Iqbal
  
  evo working fine… might be signal problem at your end..
  just downloaded 292 Mb file in one attempt…
  - anonymous
    
    no signal problem facing disconnectivity
Hassan Salman Saeed

Its better to clear the history and then use it.. google.com…
http://www.facebook.com/bilal.iqbal.775 Bilal Iqbal

page removed by Google…
restoring might be in progress…
http://twitter.com/adyniz Adil Nizamani

Lol, only the home page is down.
If you try to Google something from the Chrome address bar, it works absolutely fine.

Misleading title for an article, since only the “homepage” has been hacked, not the entire website.
http://www.facebook.com/junaid.kiyani Junaid Kiyani

A great message to Google. appreciated………….. Well Done
- Salman Abbas
  
  Ok now go back to your cave.
  - http://www.facebook.com/junaid.kiyani Junaid Kiyani
    
    I am going back to my cave.. Now you can clean your cave..
Waqas Jutt

Not working with me
drgenius11

google.com.pk is still down
but
google.com working fine..
Usman Munir

Yes Hack in morning, But know working
Guest

It is not Google, but instead PKNIC account of the agent MarkMonitor instead, the hacker was able to change DNS addresses to freehostia.com.
http://www.facebook.com/profile.php?id=100000966129723 Hamza Younus

now Google.com opening not .com.pk
http://aaqil.co.uk/ Aaqil Mahmood

I think someone is trying to create hatred among Turkish and Pakistani people.

waisay bhi google pakistan konsa Pakistanio nay banaya hay
aslamweb

only http site is hacked not HTTPS .. HTTPS is working cool ..

:::

eboz of a friend always there for me My homies have not shot by me with every breath

Downed Pakistan

?
trabzon 2012Hello friends who are still alive not dead!
http://www.facebook.com/MuhammadSaad.Shafiq Muhammad Saad Shafiq Qadri

Really a great shame for Google, must be done by some genius hackers out there wanna learn it too.
http://www.facebook.com/waqas.ahmad.9634 Waqas Ahmad

Might this could be reaction to Block Mobile Networks
http://www.paksc.org/ Abdul Rauf

hmm not working..
madmax124

paypal.PK dafauq is that ???
- http://www.facebook.com/sonyaanjumsaba Sonya Anjum Saba
  
  Pay Pal does not have any link up with PK so far… upto my correspondence with their support team!!!
rizwanshahzad

How much time more for restoring?
http://www.facebook.com/Axal7 Arsal Versal

Its just because Pakistani hackers deface over 30 Israeli websites to show support for Gaza…
عادل بھیا

From the last few days, Pakistani Hackers are in action and are keep on hacking Israeli different important websites just to show their respect towards muslims and their anger towards Israeli’s f__k policies…. May be all of this be the result of that Paki hacker’s act!
rizwanshahzad

.pk domains down due to security reasons for moharram,by rehman malik……………lolzz
rizwanshahzad

Google.com.pk is restored.
Karkum

Google Translate, Translates it as My homies is not with me I always have with me for a friend with every breath shot

And the footer line says My homies is not with me I always have with me for a friend with every breath shot

And not only that, The hacker just haven’t hacked Pakistani domains but even thousands of different domains

https://www.google.com/search?q=dostlara+selam+%C3%B6lmedik+hala+ya%C5%9F%C4%B1yoruz&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a
Karkum

And the Turkish hacker is eboz http://www.dl4hacks.net/user-4952.html
http://www.facebook.com/profile.php?id=1137377371 Asad Ali

not accessable, connection reset error…… even ip is not accessable. server has been retarded :(
Moazzam

It says downed by Eboz!! he is a turkish hacker. To everyone the page asks you to download a plugin dontt !!!
ahmad khan

off topic but just clicked a link at Facebook got re routed to youtube and suddenly video started playing. Did i miss any notification issued about opening youtube in pakistan? I am on EVO by the way.
http://www.facebook.com/rqadri Raza Qadri

yar ab ishq mamnu kai bad turkish citizens nai aik aur musibat bna di :P
- http://www.facebook.com/adsense555 Raheem Khan
  
  Aray wahh ab bhi dekhte ho kya :P
- S.K.
  
  Great …. Super Likes … !
http://chotabheemseries.blogspot.com/ Gulab Shah

nothing is safe in pakistan o_O
KYASIR

I really LiKe The HACKERS.
I wish to be a HACKER.
http://twitter.com/i_amAamir Ææmįr Mōhâmmåd

i bet its the israeli hackers
http://www.facebook.com/amcifer آمنہ مختار

thank God that i use olny .kr sites :P
Asim Rana

lolxx.. deface page was hosted on freehostia as i checked dns. so i let them know about it and now they suspended hosting account of that person who did it ..

Hello,

The account has been suspended.

Kind Regards,

Kevin Johnson

Support@Freehostia.com

http://www.Freehostia.com
retergt

Haha Pakistani Fuckers!!
- http://www.facebook.com/adsense555 Raheem Khan
  
  Retard NOOB, NERD, Blah blah blah
http://www.facebook.com/chmuzamil Muzamil Chaudhery

All The Websites Hacked Are Only Multinational Websites. Like Fanta.pk , http://www.ebay.pk ,www.msn.org.pk , http://www.hp.com.pk , http://www.apple.pk , http://www.microsoft.pk
http://mobilephones.pk/ DrRoot

It is a registry level hack! they have gotten into Pknic and managed to change dns of sites like google.com.pk at this point it seems like Google.com.pk dns is pointed to a free dns host, which as of now is suspended. Hacker could have poisoned all .pk domains, would of been a biggest hack of century! https://twitter.com/ThisIzSparta/status/272290661309497346
http://www.facebook.com/chmuzamil Muzamil Chaudhery

Jitni Website Bhe Hacked Hoi Hain Sab Ki Sab Multinational Companies Ki Thi. Or Tmam Ka NS dns1.freehostia.com , dns2.freehostia.com Per Set kiya gaya he.
i Think PKNIC K Database Se Koi Gar Bar hoi he. Wo Tmam .pk Domain Hacked Hoaay Hain Jin Ka CNAME Redirected Tha.
http://www.facebook.com/adsense555 Raheem Khan

Aamir bhai ap kese bach gaye .PK to apka bhi he shukar manayen!!
http://www.facebook.com/zubair.ali.malik Zubair A. Malik

so technically pknic was hacked :P
Ghayoor Shaikh

It is really creating a mayhem in the image of paki people about the Hackers
Shameel Faraz

There was a paypal.com.PK ??? how did no one knew abt it ? and did paypal.com.pk provides payment services for pakistan ??
http://www.facebook.com/badar.iqbal Badar Iqbal

turkish prime minister visited Ghaza as solidarity of Muslims. Pakistani hackers hacked their websites. Jews are very sensitive to their enemies. Thats why they pictured such event to disheart people of Pakistan and to counter attack on us. in other words aik teer sa do shikaar.
luqman

so where are the smart hacker …..
they should have foreseen the attack and must have defended it ….
if they can not defend us then should not enter the game ….
http://twitter.com/Aamir35 Aamir Jalil

Hun Aram eh .Hor lo Pangye……. !
http://twitter.com/wpthemes_hq haroon javed

Now the site is back they just change the main servers that why it takes time to re-update the servers name back. believe me this is noting big they cant hack internet giant google original servers:))
chand

My homies is not with me I always have with me for a friend with every breath shot .

kankalarim hep yanimda arkadas icinde yanimda olmayan mi var cekimlik her nefeste .
Syed Shoaib Raza

All the websites can be open easily. It is a fake news.
http://twitter.com/khanisgr8 khan

http://tny.cz/44e5a1d5 Full report ..Admin should publish this report also in new post
http://twitter.com/pomy Pomy Mughal

@Admin: Where is my last comment for this story?
Karim

Pakistani’s are earning enough with non PK domains then why should we worry about these domains :P
http://www.facebook.com/leolove110 Syed Asad Ali Rizvi

Here is my observation:

Most of them are well known cTlds for example, microsoft.pk, yahoo.pk, ebay.pk, visa.com.pk, paypal.pk, sony.pk etc.

Interesting part is they all have 2 things in common:

1. They are all registered through PKNIC
2. They are all “not in use” domains and registered for Brand and identity protection only (in simple words, so that no one else can have it).

Hackers had access to PKNIC as they modified NS entries for each domain and change to dns1.freehostia.com and dns2.freehostia.com respectively.

I have a feeling that these domains were ignored or forgotten by their owners. Every domain is set to expire in less than 4 months if you closely observe. These domains domains were not actively used and there was no pages to serve on these domains. They were all registered by a single company : MarkMonitor. who is responsible to manage brand protection, etc. for all of the above companies.

any feedback?
JM

PKNIC has a big problem of ns name grouping, first of all user need to create a ns name record group and then allocate it to a domain or set of domains

if some one need to change in ns then he need to create a new ns group not directly. if you just locate the domain and click the ns to change it will change the whole group not a single domain.

So that could be reason for mark monitor