Risk

Domain Security Needs More Than Registry Locks

Protecting domains requires registry locks as well as other measures, including two-factor authentication and administrative access control

Today's networking infrastructure relies on the domain name system -- not only a company's public-facing Web servers and Internet appliances, but much of its private infrastructure as well.

But enterprises need to better protect their DNS environments, as last week's attack on a reseller of domain registrar MelbourneIT and the subsequent redirection of The New York Times, the Huffington Post, and two subsidiary Twitter domains demonstrated. While the attacks should not have come as a surprise, the vast majority of companies are unprepared for such malicious attention.

Only a small fraction of companies are taking the security measures necessary to protect their domains from attack, says Danny McPherson, vice president and chief security officer for VeriSign. Even companies and individuals that are conscious of security issues tend to give their domain name registrations short shrift, he says.

"People invest tens or even hundreds of millions of dollars on content distribution infrastructure, data centers, and other things, and they use a fixed password with their registrar and a $10 domain name," he says.

Following last week's compromise, companies jumped to protect their domains from changes using a registry security feature known as a registry lock. Yet McPherson and others point out that a registry lock, while an essential step to protecting a business's domain, is not sufficient. Companies need to take an in-depth look at how they handle their domains, who has access to those domains, and the vetting of their registrars, he says.

Two documents produced by the Internet Corporation for Assigned Names and Numbers (ICANN) are a good starting point for companies. Produced by ICANN's Security and Stability Advisory Committee, the documents -- SAC040 and SAC044 -- inform companies about the measures their registrar uses to protect registration services against misuse and advises businesses about how to protect their own domain names.

As described, a registry lock protects domains against changes, deletion, and transfers using registrar status codes. But security experts and the documents recommend other steps as well:

1. Check out your registrar
By all accounts, MelbourneIT is a responsible, security-conscious registrar. Despite that good reputation, hacktivists circumvented the company's business processes to gain control of its domain administration system for a short time.

Like any third party, registrars should be quizzed on their security measures, says Jaime Blasco, director of research for unified-security provider AlienVault. While smaller firms may not have the clout of larger firms, they can still shop around and ask for additional security measures for their domain, he says.

"If you are a big company, ask the registrar what security mechanisms do they have in place as part of your risk-assessment process," Blasco says. "Taking into account how secure the registrar is should be one of the priorities for companies right now."

2. Passwords are not good enough
Securing the foundation of business infrastructure with a simple password, no matter how complex, is dangerous. Any business that does not take more stringent security measures is a single phishing attack away from losing their domains, says Rodney Joffe, senior vice president and technologist at domain-registry Neustar.

Companies should have at least two-factor authentication in place, so that any change to the domain records requires a passcode sent or generated through another channel. Because e-mail accounts tend to be a first target of attackers, using two-factor authentication that relies on e-mail is not good enough, Joffe says.

"Obviously if a domain holder's email account has been compromised, the hijacker can still get the second factor and make changes, so the better systems typically utilize text messages to cell phone numbers," he says.

3. Track access to DNS records
While two-factor authentication can shrink the attack surface area that leads to a company's domain records, businesses also need to minimize the number of employees with the ability to change a domain records. At the same time, having multiple points of contact can add redundancy that is important in an emergency.

Overall, companies should make sure that each step of the domain name system has adequate points of contact and verify that only the people who need to access the systems have authorization, says VeriSign's McPherson.

"It's important for people to consider the ecosystem, all the way from the registrant, all the way forward to something like DNSSEC to even validating recursive name servers in the infrastructure," he says. "It helps you to minimize your attack surface in the active infrastructure."

[A report has sparked a new round of discussions about policing the Internet ecosystem and whether the Internet Corporation for Assigned Names and Numbers (ICANN) is doing enough to combat the problem. See Rogue Domain Registrars Pose Challenges.]

4. Monitor your DNS records for changes
Registry locks, DNS Security and other technologies are not infallible protections against attackers, but are methods of raising the bar higher. But just as important, in circumventing the protections, attackers will essentially set off alarms.

For that reasons, companies need to be monitoring their DNS records to any unauthorized changes, says AlienVault's Blasco.

"Implementing monitoring and health checks of the infrastructure is one of the key things that companies can do," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11486
PUBLISHED: 2019-04-23
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.
CVE-2019-11487
PUBLISHED: 2019-04-23
The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hu...
CVE-2018-7576
PUBLISHED: 2019-04-23
Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.
CVE-2018-8825
PUBLISHED: 2019-04-23
Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).
CVE-2019-10688
PUBLISHED: 2019-04-23
VVX products using UCS software version 5.8.0 and earlier with Better Together over Ethernet Connector (BToE) application version 3.8.0 and earlier uses hard-coded credentials to establish a connection between the host application and device.