Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Infrastructure Security //

DNS

1/11/2019
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Iran Suspected of 'Stealthy & Sophisticated' DNS Hijacking Campaign

New research from FireEye suggests that a group working within Iran is behind a large-scale DNS hijacking scheme that involves web traffic all across the globe.

Iran seems to have been conducting the Mother of All DNS Hijackings over the last year, according to new research from FireEye.

In its report, researchers describe a year-long DNS hijacking campaign that was equally stealthy and sophisticated. The hijacking has affected dozens of domains belonging to government, telecommunications and Internet infrastructure entities across the Middle East and North Africa, as well as Europe and North America.

While there is no direct attribution to Iran available, FireEye has identified access from Iranian IPs to machines used to intercept, record and forward network traffic. They note that geolocation of an IP address is a "weak" indicator, but that these IP addresses have been previously observed during the response to an intrusion attributed to Iranian cyberespionage actors.

The report notes that researchers have "moderate" confidence that the hijacking has been conducted by persons based in Iran and that -- more importantly for attribution purposes -- the activity aligns with Iranian government interests.

(Source: iStock)
(Source: iStock)

The first method exploited by the attackers is altering DNS A records. This misdirects mail traffic to the listening post set up by the attacker on a load balancer. Credentials are extracted and stored on the rogue load balancer.

A second method used is to modify the DNS NS records after hacking into the victim's domain registrar account. The name server record will give the correct IP for a web request that is made, but it will forward any mail requests to the attackers' listening post. The username, password and domain credentials are harvested and stored, then the mail request is sent to the correct IP.

Let's Encrypt certificates are used to avoid setting off alarms when the information is redirected.

A DNS redirector and previously altered A and NS records form a third method that is also used by the attackers. Requests from outside the affected domain go to the correct mail server, but requests from inside the domain go to the listening post.

One of the FireEye report writers sounded the alarm on Twitter, noting that the attacks and scope were "huge."

The researchers recommend that two-factor authentication for DNS and TLD management accounts should be enabled. They also note that that IT and security admins should be alert for any changes made to DNS A or NS records.

Google is also taking some steps that may aid in combatting DNS hijacking, but it is only currently implemented for Android 9 Pie systems.

The search giant's DNS resolver is, according to the company, "the world's largest public Domain Name Service (DNS) recursive resolver." Googlers are adding the DNS-over-TLS protocol, which specifies a standard way to provide security and privacy for DNS traffic between users and their resolvers. It uses TLS, which is the same technology that is in use to protect HTTPS web connections.

Google is also implementing the RFC 7766 recommendations, which can minimize the overhead of using TLS. These include support for TLS 1.3 -- for faster connections and improved security -- TCP fast open, and the pipelining of multiple queries and out-of-order responses over a single connection. (See OpenSSL 1.1.1 Released With TLS 1.3 Support.)

DNS hijacking has proven to be a stubborn security problem. Increased awareness by security teams of the depth of the problem, along with improved support by Google and others, will go a long way in resolving it.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3454
PUBLISHED: 2021-10-19
Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx88-6c29-...
CVE-2021-3455
PUBLISHED: 2021-10-19
Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions >= 2.4.0, >= 2.5.0 contain Use After Free (CWE-416). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7g38-3x9v-v7vp
CVE-2021-41150
PUBLISHED: 2021-10-19
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is c...
CVE-2021-31378
PUBLISHED: 2021-10-19
In broadband environments, including but not limited to Enhanced Subscriber Management, (CHAP, PPP, DHCP, etc.), on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be fo...
CVE-2021-31379
PUBLISHED: 2021-10-19
An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed IPv4 or IPv6 packets to cause a Denial of Service (DoS) to the PFE on the device which is disabled as a result of the processing of these pac...