A Deep Dive on the Recent Widespread DNS Hijacking Attacks

ronjor · Feb 18, 2019

The U.S. government — along with a number of leading security companies — recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private companies. But to date, the specifics of exactly how that attack went down and who was hit have remained shrouded in secrecy.
Click to expand...

https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks/

guest · Feb 20, 2019

DNSpionage hacks: Time for DNSSEC?
February 19, 2019
https://www.scmagazineuk.com/dnspionage-hacks-time-dnssec/article/1526123

The vast wave of attacks has resulted in the attackers slurping up huge numbers of login credentials, in essence by faking DNS records, so that a legitimate domain points to an IP address controlled by the attacker, rather than the domain’s rightful owner.

Although this process of DNS hijacking has been common knowledge for some years, this campaign – dubbed DNSpionage – has refined DNS hijacking into a potent tool.
In the last few months alone, those behind the DNSpionage campaign have compromised vital components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies.

"When DNS was designed decades ago it was utility, not security, that was front of mind. DNS’s security limitations have been widely understood for some time, yet subsequent security extensions such as DNSsec, whilst growing in use, are yet to become the norm. [...]"
Click to expand...

itman · Feb 20, 2019

mood said: ↑

Time for DNSSEC?
Click to expand...

As noted in the article, DNSSEC has to be universally applied for it to be of any value:

Concerningly, although both Netnod and PCH are advocates and adopters of DNSSEC (DNS Security Extensions), a technology designed expressly to prevent these types of attack, the attackers were able to circumvent the protections. This was mainly possible because of spotty implementation of DNSSEC globally, with only about 20 percent of the world’s major networks being compliant. The attackers initially targeted Netnod infrastructure that was not compliant, and once in were able to disable DNSSEC long enough to request new SSL certificates before re-enabling it.
Click to expand...

ronjor · Apr 17, 2019

The wave of domain hijackings besetting the Internet is worse than we thought

Dan Goodin - 4/17/2019
Despite widespread attention since January, DNS campaign shows no signs of abating.
Click to expand...

guest · Jul 9, 2019

Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
July 9, 2019
https://blog.talosintelligence.com/2019/07/sea-turtle-keeps-on-swimming.html

After several months of activity, the actors behind the "Sea Turtle" DNS hijacking campaign are not slowing down. Cisco Talos recently discovered new details that suggest they regrouped after we published our initial findings and coverage and are redoubling their efforts with new infrastructure. While many actors will slow down once they are discovered, this group appears to be unusually brazen, and will be unlikely to be deterred going forward.

Additionally, we discovered a new DNS hijacking technique that we assess with moderate confidence is connected to the actors behind Sea Turtle. This new technique is similar in that the threat actors compromise the name server records and respond to DNS requests with falsified A records. This new technique has only been observed in a few highly targeted operations.
Unfortunately, unless there are significant changes made to better secure DNS, these sorts of attacks are going to remain prevalent.
Click to expand...

Log in or Sign up

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

ronjor Global Moderator

guest Guest

itman Registered Member

ronjor Global Moderator

guest Guest

Log in or Sign up

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

ronjor Global Moderator

guest Guest

itman Registered Member

ronjor Global Moderator

guest Guest

Useful Searches