Yesterday evening, I was wondering why an e-mail of mine to a friend using Comcast's e-mail bounced. Then I saw a message on a listserv I use asking if anyone else had experienced difficulty sending e-mail to Comcast addresses. Thirty seconds and one Google search later, I discovered why. "Slashdot explains":http://it.slashdot.org/it/08/05/30/1233236.shtml:
bq. Fallen Andy notes that Comcast, one of the largest US ISPs, lost control of its domain name to what appeared to be juvenile social engineers of the old school — i.e. not in it for the money. The intruders got into Comcast's registrar account at Network Solutions and repointed the domain's DNS records. A blog entry at SANS points out how trivially easy this can be. Reader ElvenKnight points out an insightful interview up at Wired with the two young guys who perpetrated the hack.
While I'm sure Comcast and its customers are none too happy about this incident, it's probably a positive for them in the sense that the hackers were tricksters, not serious criminals. Using the same technique, a criminal organization could have delivered malware or collected usernames and passwords (or potentially bank/credit card account information). Hopefully, Comcast, the domain registrars, and other companies will learn from this example and will tighten up their security processes and controls to reduce the risk of more dangerous abuses in the future.