I haven't heard the full details but once you have control of a domain name, there's a lot you can do. If you can reset or recover your password with an email, if someone gets the domain, they can redirect all email to that domain to their own mail server. Et voila, they're in. If your site doesn't use HTTPS (and possibly even if it does), there are man-in-the-middle attacks.
It's even not terribly hard to take control of a domain name even without social engineering. Typically, most registrars just require a copy of your DL on company headed notepaper and some trivial other stuff. I've had to do it for domains that were legitimately our company's several times.
It's even not terribly hard to take control of a domain name even without social engineering. Typically, most registrars just require a copy of your DL on company headed notepaper and some trivial other stuff. I've had to do it for domains that were legitimately our company's several times.
Though with that said, security really shouldn't depend on DNS if it's being done properly. I'd be interested to hear what the actual method of attack was just to see if it's one I've heard of.
This was explained in the blog post but essentially they redirected emails to a server under their control and got sent a password reset link.
