DNS Infrastructure Hijacking Campaign

ronjor · Jan 10, 2019

Original release date: January 10, 2019

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolves. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks.
NCCIC encourages administrators to review FireEye’s blog on global DNS infrastructure hijacking for more information. Additionally, NCCIC recommends the following best practices to help safeguard networks against this threat:
Click to expand...

ronjor · Jan 22, 2019

CISA Emergency Directive on DNS Infrastructure Tampering

Original release date: January 22, 2019
The U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to address ongoing incidents associated with global Domain Name System (DNS) infrastructure tampering. Multiple executive branch agency domains were impacted by the tampering campaign. The directive requires Federal agencies to take specific steps and comply with reporting procedures to mitigate risks from undiscovered tampering, prevent illegitimate DNS activity, and detect unauthorized certificates.
Federal agencies should review Emergency Directive 19-01 for required actions and reporting procedures.
Click to expand...

ronjor · Jan 24, 2019

DNS Infrastructure Hijacking Campaign

Original release date: January 24, 2019
Summary
The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolve. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks.
See the following links for downloadable copies of open-source indicators of compromise (IOCs) from the sources listed in the References section below:

IOCs (.csv)
IOCs (.stix)

These files will be updated as information becomes available.
Click to expand...

ronjor · Jan 24, 2019

CISA Releases Blog on Emergency Directive

Original release date: January 24, 2019
The U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) Director Christopher Krebs, has released a blog, titled “Why CISA Issued Our First Emergency Directive,” to explain considerations in issuing Emergency Directive 19-01 on January 22, 2019. The directive requires Federal civilian agencies to take a series of immediate actions in response to a global Domain Name System (DNS) hijacking campaign.
The National Cybersecurity and Communications Integration Center (NCCIC), part of CISA, recommends Federal agencies review the CISA Blog for more information.
Click to expand...

Log in or Sign up

DNS Infrastructure Hijacking Campaign

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

DNS Infrastructure Hijacking Campaign

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches