hushmail redirected

[Siegfried <siegfri3d () gmail com>]

hushmail got redirected for a few hours this morning, we wrote a news about 
it but we've been under a large ddos attack after sending it to the press, 
weird! hushmail posted a message on their web site saying it that network 
solutions was responsible (trust them or not, maybe they'll release more 
details later):
https://www.hushmail.com/login-status?

Here is the content of the news, before the site went offline:

Hushmail.com defaced by means of DNS redirection UPDATED
Siegfried, SyS64738 Zone-H Admins
04/24/2005

The web site hushmail.com of Hush Communications, providing secure email 
services, was defaced over the week-end, visitors being redirected to a 
different server after an attacker got access to Hushmail DNS maintenance 
panel.

It was first noticed very early this morning, when the domain 
www.hushmail.com began to redirect users to a page containing the following 
message: "The Secret Service is watching. -Agent Leth and Clown Jeet 3k 
Inc". The DNS were changed to DNS1.EVONEXUS.NET DNS2.EVONEXUS.NET while 
hushmail are using their own servers (NS*.HUSHMAIL.COM) and the information 
on the whois was hijacked:

Administrative Contact, Technical Contact:
Smith, Brian clownowns () yahoo com
Hush Communications

Maybe the attacker got somehow this contact's password, whose email address 
was admn () HUSHMAIL COM (according to the data on the whois of hush.com) and 
modified the data of the domain on the Network Solutions web site, their 
registry.

On sunday 4am GMT the page was removed, probably by burst.net, which was 
hosting it, the emails sent to the hushmail.com users were bounced back to 
the sender at the time of writing.

The attacker didn't use the web site for a malicious purpose, but it is 
indeed a bad news for Hush Communications, whose credibility was seriously 
damaged.

A mirror of the "defacement" is available here:
http://www.zone-h.org/defacements/mirror/id=2309823/

UPDATE

Currently at 08:35 AM GMT+1 the site Hushmail.com is reachable in Europe 
only by its IP address 65.39.178.11 while the query through DNS doesn't 
resolve.

Click here to view the current status of Hushmail Whois
http://www.zone-h.org/files/77/hushwhois.htm

Original article: http://www.zone-h.org/en/news/read/id=4467/ 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/