Explaining the hacking of T.C.S official website so that even a laymen can understand.

The official website of Tata Consultancy Services, TCS.com, India’s largest software provider, has been hacked on 7 feb 2010.
Their homepage says:

    Ce nom de domaine est a vendre
    Merci de nous contacter pour obtenir de plus amples informations.
    abed_uk@hotmail.com

Translated in English from French

This domaine name is for sale. Please contact us for further informations.
    abed_uk@hotmail.com

The hacker has also put up a whos.among.us widget displaying current traffic on the homepage.

Its believed that it is not the tcs.com that was hacked(means the website hosting server) but it's the dns of tcs.com that was hacked or cached poisened.

Let me expain in depth what had happened so that even a laymen can understand the concept.

Starting from basic.

• Website is simply data.
• Data needs to be stored somewhere.
• It is stored on hard disk's of server.
• Servers are the unit that respond to your queries(like sending webpage so that our computer can display it.They serve us that's why they are called server)
• Servers are like desktop computers but have very enhanced capability and very fast internet connection
• To access server we need its address just like for delivering a post mail we needsits delivery address
• This address is called IP address(internet protocol address).
• IP addresses are in numerical format like 123.32.45.167.
• They are difficult to remember,So we need a more human appoach for this.
• In this regard Domain name come's to our rescue.
• By associating a name with an IP address it is now easy for humans to go to a particular website.

For example,By associating a name example.com with an IP address 123.32.45.167,we can make that server more appoachable to human society.Names are much easy to remember as compared to numbers.

The table of domain names associated to their IP addresses is stored at a separate server and
this server is called as domain name server.
The address to this server is generally provided to us by our ISP(internet service provider).

So when we type the name of the website,example http://www.example.com,in our browser the following
events happen

• We request to display the content of http://www.example.com by typing the domain  name in browser.
• DNS converts http://www.example.com to its corresponding IP address say 123.32.45.167 and forwards the display of content request to this address
• Website http://www.example.com is hosted on this server and its IP address is 123.32.45.167.
• Data requested for display is send to our computer by website hosting server.

The following block diagram will clear all your doubts regarding the above explaination.

In this whole process basically two servers are included.One is dns and the other is where the website is hosted.
So inorder to hack any website,We need to hack its hosting server or its applications like
Mysql database etc.Or we can do one more think,We can hack the dns.
Through hacking dns, we will be able to change the IP adderess associated with its domain name with
our liked one.
Hacking dns includes changing the database of dns or dns cache poisoning(cache hijacking).

What might happens in case of tcs:
The Internet Protocol (IP) address of TCS’s website is 216.15.200.140. However, the hackers changed it to 205.178.152.154.
The page showing that "This domaine name is for sale. Please contact us for further informations." is hosted on
205.178.152.154.So it was not tcs.com that was hacked it was its registrar's dns that was.


Hope you enjoyed this post.
Please leave comments.They will be highly appreciated.