Cyber Incident Victim: Google Indonesia
Date:
Oct 2014
Location:
Indonesia
Summary
The Google Indonesia homepage was defaced by hacker group Team MaDLeeTs, who replaced it with a message stating "Security is just an illusions" during a local holiday. The attackers compromised Indonesia's domain registrar infrastructure to execute DNS poisoning, redirecting users attempting to access the search engine's homepage to their defaced version for several hours. While Google's own servers remained secure, the incident exposed vulnerabilities in Indonesia's domain management systems, with the Pakistani-based group having previously targeted Google Malaysia through similar methods.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 5, 2014, during Indonesia's Idul Adha holiday, the google.co.id homepage was defaced by a hacking group identifying as Team MaDLeeTs. The attackers replaced the standard Google Indonesia interface with a message stating "Security is just an illusions" alongside their group name, which references hacker terminology for 'elite' through the "LeeT" spelling. Initial public detection occurred around 10:00 AM local time, with the altered site remaining accessible for multiple hours before domain restoration. The Pakistani-based group had previously claimed responsibility for compromising Google Malaysia's homepage in a similar fashion one year earlier. Technical analysis indicated Google's core infrastructure remained unaffected, as the attack targeted domain routing rather than penetrating Google's servers directly.
The compromise was executed through DNS poisoning after Team MaDLeeTs breached Indonesia's official Domain Registrar. This manipulation redirected users attempting to access google.co.id to the defaced content hosted on the attackers' server instead of Google's legitimate infrastructure. No Google user data—including Gmail accounts or search histories—was compromised, as the company's security systems were not breached. The incident exposed vulnerabilities in Indonesia's national domain registration system rather than weaknesses in Google's defenses. Full service restoration occurred once DNS records were corrected to point to Google's authentic servers, eliminating the redirection. The event highlighted systemic risks within Indonesia's internet governance framework while demonstrating the resilience of Google's internal security architecture against direct intrusion.