Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Infrastructure Security //

DNS

// // //
1/11/2019
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb

Iran Suspected of 'Stealthy & Sophisticated' DNS Hijacking Campaign

New research from FireEye suggests that a group working within Iran is behind a large-scale DNS hijacking scheme that involves web traffic all across the globe.

Iran seems to have been conducting the Mother of All DNS Hijackings over the last year, according to new research from FireEye.

In its report, researchers describe a year-long DNS hijacking campaign that was equally stealthy and sophisticated. The hijacking has affected dozens of domains belonging to government, telecommunications and Internet infrastructure entities across the Middle East and North Africa, as well as Europe and North America.

While there is no direct attribution to Iran available, FireEye has identified access from Iranian IPs to machines used to intercept, record and forward network traffic. They note that geolocation of an IP address is a "weak" indicator, but that these IP addresses have been previously observed during the response to an intrusion attributed to Iranian cyberespionage actors.

The report notes that researchers have "moderate" confidence that the hijacking has been conducted by persons based in Iran and that -- more importantly for attribution purposes -- the activity aligns with Iranian government interests.

(Source: iStock)
(Source: iStock)

The first method exploited by the attackers is altering DNS A records. This misdirects mail traffic to the listening post set up by the attacker on a load balancer. Credentials are extracted and stored on the rogue load balancer.

A second method used is to modify the DNS NS records after hacking into the victim's domain registrar account. The name server record will give the correct IP for a web request that is made, but it will forward any mail requests to the attackers' listening post. The username, password and domain credentials are harvested and stored, then the mail request is sent to the correct IP.

Let's Encrypt certificates are used to avoid setting off alarms when the information is redirected.

A DNS redirector and previously altered A and NS records form a third method that is also used by the attackers. Requests from outside the affected domain go to the correct mail server, but requests from inside the domain go to the listening post.

One of the FireEye report writers sounded the alarm on Twitter, noting that the attacks and scope were "huge."

The researchers recommend that two-factor authentication for DNS and TLD management accounts should be enabled. They also note that that IT and security admins should be alert for any changes made to DNS A or NS records.

Google is also taking some steps that may aid in combatting DNS hijacking, but it is only currently implemented for Android 9 Pie systems.

The search giant's DNS resolver is, according to the company, "the world's largest public Domain Name Service (DNS) recursive resolver." Googlers are adding the DNS-over-TLS protocol, which specifies a standard way to provide security and privacy for DNS traffic between users and their resolvers. It uses TLS, which is the same technology that is in use to protect HTTPS web connections.

Google is also implementing the RFC 7766 recommendations, which can minimize the overhead of using TLS. These include support for TLS 1.3 -- for faster connections and improved security -- TCP fast open, and the pipelining of multiple queries and out-of-order responses over a single connection. (See OpenSSL 1.1.1 Released With TLS 1.3 Support.)

DNS hijacking has proven to be a stubborn security problem. Increased awareness by security teams of the depth of the problem, along with improved support by Google and others, will go a long way in resolving it.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29117
PUBLISHED: 2022-08-12
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVE-2021-29118
PUBLISHED: 2022-08-12
An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
CVE-2022-2797
PUBLISHED: 2022-08-12
A vulnerability classified as critical was found in SourceCodester Student Information System. Affected by this vulnerability is an unknown functionality of the file /admin/students/view_student.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The...
CVE-2021-29112
PUBLISHED: 2022-08-12
An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
CVE-2022-35980
PUBLISHED: 2022-08-12
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features doc...