Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/16/2018
05:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Frequency & Costs of DNS-Based Attacks Soar

The average cost of a DNS attack in the US has climbed 57% over the last year to $654,000 in 2018, a survey from EfficientIP shows.

The frequency of Domain Name System (DNS) attacks and the costs associated with addressing them are both increasing sharply, a new survey by EfficientIP shows.

The DNS management vendor recently had research firm Coleman Parkes poll about 1,000 IT managers in North America, Asia, and Europe on the causes and responses to DNS-based threats.

The results showed that the global average costs of DNS attacks have surged 57% over 2017 to $715,000 in 2018. In the past 12 months, organizations faced an average of seven DNS attacks. Some of the victims ended up paying more than $5 million in associated costs. One in five (22%) organizations suffered business losses to DNS attacks.

The costs per DNS attack associated with remediation, recovery, and business disruption tended to vary by region. In North America, organizations in the US had the highest average costs, at around $654,000. Companies in the region also experienced the steepest year-over-year increase in costs at 82%. Overall, though, organizations in France had higher costs associated with DNS attacks than anywhere else, with victims spending an average of $974,000 on one.

"DNS attacks cost so much because consequences are instantaneous, broad, and very difficult to mitigate without the appropriate technology," says Ronan David, senior vice president of strategy for EfficientIP. "In modern networks, DNS is routing access to almost all applications."

Contributing to the high attack costs and overall complexity is the fact that DNS is both an attack vector and a target, he says. Attackers can use the DNS infrastructure as a vector for stealing data, for communicating with command and control servers, for setting up malicious phishing and spam domains, and for enabling other kinds of malicious activity. Other attacks, though, are targeted at disrupting DNS services directly, such as DNS distributed denial-of-service (DDoS) attacks.

DDoS attacks against DNS infrastructure in particular can be very costly to remediate, chiefly because such attacks are asymmetric, says Cricket Liu, chief DNS architect at Infoblox. "An attacker just needs to hire a botnet for a few hours to launch the attack, but the organization targeted needs to build excess capacity and maintain it year-round," in addition to possibly using a DDoS mitigation service, Liu says.

The five most common DNS-based attacks in EfficientIP's survey included those in which DNS is used as an attack vector and those in which an organization's DNS infrastructure is the target. Topping the list for 2018 is DNS-based malware followed by phishing, DNS tunneling, domain lock-up, and DNS-based DDoS attacks.

"With 33% of people having suffered data theft, DNS is certainly one of the most powerful attack vectors," says EfficientIP's David from. At the same time, the survey also showed that 40% of cloud-based application downtime is caused by attacks aimed at DNS servers and service.

Hackers are developing sophisticated new multivector, multistage, and distributed DNS attacks. The exponential rise of connected devices, Web-based applications, and interconnected networks is giving them a broader surface to attack as well, David says. "DNS is, therefore, a primary vector and target leading to higher damage costs."

Merike Kaeo, CTO at Farsight Security, says DNS is a more fundamental and complex protocol than most people realize. "It is critical to not only name and address resolution but can also be utilized to define email servers associated with a domain name, identify service locations, specify type of OS or CPU on a host, and other Internet-related activities."

As attacks against DNS increase and become more sophisticated, it's no surprise that remediation costs are increasing as well, Kaeo says. What surveys like those by EfficientIP show is that organizations need to start paying attention to their DNS infrastructure, she says.

"Know which domains you use and what can potentially be abused," Kaeo notes. Pay attention to the security practices of registries and registrars and implement controls for determining changes in DNS traffic patterns and for blocking unknown domains, she says.

Review your existing mechanisms for dealing with DNS threats as well, says David. Most are simply workarounds that are not designed specifically for dealing with DNS threats. As an example, he points to data exfiltration attacks via DNS. The appropriate detection capacity requires real-time and context-aware DNS traffic analysis for behavioral threat detection, he says.

"DNS is by design an open service on the network which is not correctly monitored, and for which a traditional security solution cannot protect efficiently," he notes. "DNS is mission-critical. When it goes down, the business is down."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15224
PUBLISHED: 2019-08-19
The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVE-2019-15225
PUBLISHED: 2019-08-19
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.
CVE-2019-15223
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
CVE-2019-15211
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
CVE-2019-15212
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.