Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Infrastructure Security //

DNS

1/11/2019
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Iran Suspected of 'Stealthy & Sophisticated' DNS Hijacking Campaign

New research from FireEye suggests that a group working within Iran is behind a large-scale DNS hijacking scheme that involves web traffic all across the globe.

Iran seems to have been conducting the Mother of All DNS Hijackings over the last year, according to new research from FireEye.

In its report, researchers describe a year-long DNS hijacking campaign that was equally stealthy and sophisticated. The hijacking has affected dozens of domains belonging to government, telecommunications and Internet infrastructure entities across the Middle East and North Africa, as well as Europe and North America.

While there is no direct attribution to Iran available, FireEye has identified access from Iranian IPs to machines used to intercept, record and forward network traffic. They note that geolocation of an IP address is a "weak" indicator, but that these IP addresses have been previously observed during the response to an intrusion attributed to Iranian cyberespionage actors.

The report notes that researchers have "moderate" confidence that the hijacking has been conducted by persons based in Iran and that -- more importantly for attribution purposes -- the activity aligns with Iranian government interests.

(Source: iStock)
(Source: iStock)

The first method exploited by the attackers is altering DNS A records. This misdirects mail traffic to the listening post set up by the attacker on a load balancer. Credentials are extracted and stored on the rogue load balancer.

A second method used is to modify the DNS NS records after hacking into the victim's domain registrar account. The name server record will give the correct IP for a web request that is made, but it will forward any mail requests to the attackers' listening post. The username, password and domain credentials are harvested and stored, then the mail request is sent to the correct IP.

Let's Encrypt certificates are used to avoid setting off alarms when the information is redirected.

A DNS redirector and previously altered A and NS records form a third method that is also used by the attackers. Requests from outside the affected domain go to the correct mail server, but requests from inside the domain go to the listening post.

One of the FireEye report writers sounded the alarm on Twitter, noting that the attacks and scope were "huge."

The researchers recommend that two-factor authentication for DNS and TLD management accounts should be enabled. They also note that that IT and security admins should be alert for any changes made to DNS A or NS records.

Google is also taking some steps that may aid in combatting DNS hijacking, but it is only currently implemented for Android 9 Pie systems.

The search giant's DNS resolver is, according to the company, "the world's largest public Domain Name Service (DNS) recursive resolver." Googlers are adding the DNS-over-TLS protocol, which specifies a standard way to provide security and privacy for DNS traffic between users and their resolvers. It uses TLS, which is the same technology that is in use to protect HTTPS web connections.

Google is also implementing the RFC 7766 recommendations, which can minimize the overhead of using TLS. These include support for TLS 1.3 -- for faster connections and improved security -- TCP fast open, and the pipelining of multiple queries and out-of-order responses over a single connection. (See OpenSSL 1.1.1 Released With TLS 1.3 Support.)

DNS hijacking has proven to be a stubborn security problem. Increased awareness by security teams of the depth of the problem, along with improved support by Google and others, will go a long way in resolving it.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Data Breaches Affect the Enterprise
Data breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-4020
PUBLISHED: 2021-11-27
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-23654
PUBLISHED: 2021-11-26
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via C...
CVE-2021-43785
PUBLISHED: 2021-11-26
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious...
CVE-2021-43776
PUBLISHED: 2021-11-26
Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other se...
CVE-2021-41243
PUBLISHED: 2021-11-26
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be add...