A New Class of DNS Vulnerabilities Affecting Many DNS-as-Service (DNSaaS) Platforms

guest · Aug 5, 2021

Amazon and Google patch major bug in their DNS-as-a-Service platforms
August 4, 2021
https://therecord.media/amazon-and-google-patch-major-bug-in-their-dns-as-a-service-platforms/

At the Black Hat security conference today, two security researchers have disclosed a security issue impacting hosted DNS service providers that can be abused to hijack the platform’s nodes, intercept some of the incoming DNS traffic, and then map customers’ internal networks.

Discovered by Shir Tamari and Ami Luttwak from cloud security company Wiz, the vulnerability highlights the amount of sensitive information collected by managed DNS platforms and their attractiveness from a cyber-espionage and intelligence data collection standpoint.
Click to expand...

Also known as DNS-as-a-Service providers, these companies effectively rent DNS servers to corporate entities. While it’s not hard to run your own DNS name server, the benefit of using a service like AWS Route53 or the Google Cloud Platform is that companies can offload managing DNS server infrastructure to a third-party and take advantage of better uptime and top-notch security.

What the Wiz team discovered was that several managed DNS providers did not blacklist their own DNS servers inside their backends.
This effectively allowed the Wiz team to hijack DNS traffic hitting the hijacked managed DNS provider’s server. However, the Wiz team said they didn’t receive all the DNS traffic going through that server, but only dynamic DNS updates.
Click to expand...

guest · Aug 5, 2021

New DNS vulnerability allows 'nation-state level spying' on companies
August 5, 2021
https://www.bleepingcomputer.com/ne...llows-nation-state-level-spying-on-companies/

Security researchers found a new class of DNS vulnerabilities impacting major DNS-as-a-Service (DNSaaS) providers that could allow attackers to access sensitive information from corporate networks.
DNSaaS providers (also known as managed DNS providers) provide DNS renting services to other organizations that do not want to manage and secure yet another network asset on their own.

As revealed at the Black Hat security conference by cloud security firm Wiz researchers Shir Tamari and Ami Luttwak, these DNS flaws provide threat actors with nation-state intelligence harvesting capabilities with a simple domain registration.
Click to expand...

From domain name registration to wiretapping traffic indiscriminately
The exploitation process is quite simple, as they explained: they registered a domain and used it to hijack a DNSaaS provider's nameserver (in their case, Amazon Route 53) which enabled them to wiretap on dynamic DNS traffic streaming from Route 53 customers' networks.

"We found a simple loophole that allowed us to intercept a portion of worldwide dynamic DNS traffic going through managed DNS providers like Amazon and Google," the Wiz researchers said.
Click to expand...

The researchers haven't found evidence that the DNS vulnerability they uncovered was previously exploited in the wild before, but, as they explain, anyone with knowledge of the issues and the skills to abuse it "could have collected data undetected for over a decade."

"Any cloud provider, domain registrar, and website host who provides DNSaaS could be vulnerable."

Additional information and technical details are available in the report published by Wiz on Wedneday [...]
Click to expand...

Log in or Sign up

A New Class of DNS Vulnerabilities Affecting Many DNS-as-Service (DNSaaS) Platforms

guest Guest

guest Guest

Log in or Sign up

A New Class of DNS Vulnerabilities Affecting Many DNS-as-Service (DNSaaS) Platforms

guest Guest

guest Guest

Useful Searches