GTBank.com: The scary implications of domain hijacking

In the rapidly evolving world of cybersecurity, one of the most concerning threats to businesses and their customers is the hijacking of critical online assets, such as domain names. Such incidents can lead to significant disruptions, loss of customer trust, and potential financial losses.

A recent case that has garnered widespread attention is the alleged hacking of the domain name GTBank (http://gtbank.com), a major financial institution in Nigeria.

This event has caused panic among customers and raised serious questions about the security protocols the bank has in place to protect such vital online assets.

The incident

On a seemingly ordinary day, users trying to access GTBank‘s official website since August 14, 2024, have been met with an unusual and alarming situation.

The domain name, GTBank.com, appeared to have been compromised, leading to widespread speculation and concern among the bank’s customers and the broader public. 

According to Great Opomu, a Digital Generalist, who spoke about the incident, the root cause of this issue seems to lie with Register.com, the domain registrar where GTBank.com is registered.

He suggested that user login details on Register.com were compromised, which allowed unauthorised individuals to gain control over the GTBank.com domain. 

The situation has quickly escalated, with many customers taking to social media platforms like Reddit and X to express their fears and frustrations. The gravity of the situation is underscored by the fact that the GTBank website is a primary point of contact for millions of customers, and its compromise could have far-reaching implications.

How could this happen? The technical details…

To understand the full scope of this incident, it is crucial to delve into the technical aspects of domain hijacking. 

Domain hijacking occurs when a third party gains unauthorised access to the credentials needed to manage a domain name. This can happen through various means, such as phishing attacks, social engineering, or exploiting vulnerabilities in the domain registrar’s security systems.

In the case of GTBank, Great’s claims point to a potential security breach at Register.com, where user details may have been exposed. 

Once the attackers gained access to the GTBank.com domain management account, they could have made changes to the domain’s DNS settings, effectively redirecting traffic away from the legitimate website.

This explains the sudden inability of customers to access the GTBank website, as the domain could have been pointing to an entirely different server controlled by the attackers.

A snapshot of the domain’s history

To further explore the legitimacy of the claims, a comparison of the domain’s historical records offers some insights. 

The archived WHOIS record from February 2019, accessible via the Wayback Machine (http://web.archive.org/web/20190205172606/https://www.whois.com/whois/gtbank.com), provides a snapshot of the domain’s registration details as they were five years ago. At that time, the domain was registered under GTBank with all the appropriate contact information intact.

However, the current WHOIS record (https://www.whois.com/whois/gtbank.com) shows a starkly different picture. 

This shift in data is a strong indicator that the domain’s control has indeed been compromised.

The impact: Customer panic and bank response

The news of the domain hijacking has quickly spread across various social media platforms, amplifying customer concerns. 

On Reddit, users in the Nigeria subreddit voiced their worries, with one thread becoming particularly active. 

Here, users discussed the potential ramifications of the incident, including the possibility of phishing scams and other fraudulent activities that could target unsuspecting customers.

Similarly, on X, a user under the handle @nnamsoanthony highlighted the growing panic, sharing a tweet that drew significant attention. The general sentiment across these platforms is one of fear and uncertainty, as customers have questioned the safety of their funds and personal information.

Despite the widespread panic, it is important to note that, as of the latest updates, the GTBank mobile app and other digital banking services remain unaffected by the domain hijacking. 

This suggests that the incident may be isolated to the website’s domain name, with no direct impact on the bank’s core banking infrastructure. However, the lack of an official statement from GTBank has only fueled speculation, leaving customers in the dark about the bank’s efforts to resolve the issue.

What happens next?

The process of regaining control over a hijacked domain can be complex and time-consuming. 

According to Great’s analysis, GTBank will need to coordinate closely with Register.com to verify its identity and reclaim the domain. 

This involves providing detailed documentation to prove ownership of the domain and confirming that it was indeed compromised. The length of this process can vary, depending on the responsiveness of the registrar and the specific circumstances of the hijacking.

In similar situations in the past, such as the high-profile case of the New York Times’ domain being hijacked in 2013, it took several days to resolve the issue fully. 

During this time, the company had to rely on alternative communication channels to keep their users informed and mitigate the damage caused by the incident. 

GTBank might find itself in a similar position, needing to reassure its customers while working behind the scenes to regain control of its domain.

There is an argument that the perpetrator’s intent might be to extort the bank. However, as mentioned earlier, GTBank has a clear recourse to reclaim its domain. By presenting a solid case to Register.com, which includes evidence of their rightful ownership and the malicious nature of the hijacking, GTBank can demonstrate that the domain was unlawfully transferred.

Lessons learned

The GTBank domain hijacking incident serves as a stark reminder of the importance of robust domain security measures. 

For financial institutions and other organisations that rely heavily on their online presence, the potential consequences of domain hijacking are severe. To prevent such incidents, companies must implement a range of security protocols, including:

1. Two-Factor Authentication (2FA): Requiring 2FA for accessing domain management accounts can significantly reduce the risk of unauthorised access. This additional layer of security ensures that even if login credentials are compromised, the attacker would still need the second factor to gain entry.

2. Regular audits: Conducting regular security audits of domain management practices can help identify vulnerabilities before they can be exploited. This includes reviewing access logs, updating passwords, and ensuring that only authorised personnel have access to the domain management account.

3. Domain locking: Domain locking is a feature offered by many registrars that prevents unauthorised transfers of the domain. When a domain is locked, any attempts to modify the domain settings or transfer it to another registrar require additional verification steps.

4. Education and awareness: Training employees on the importance of cybersecurity and the specific risks associated with domain management is crucial. This includes educating them about phishing attacks, social engineering tactics, and other methods that attackers might use to gain access to domain credentials.

But, we are sure the team at GT Bank already knows these. 

The alleged hijacking of GTBank’s domain is a significant event with far-reaching implications for the bank and its customers. While the immediate impact appears to be limited to the website’s domain name, the incident has nonetheless caused widespread concern and highlighted the vulnerabilities that exist in the digital landscape. 

In the absence of an official statement from GTBank, customers are left with many unanswered questions. 

We will update you accordingly.