The DNS was introduced in 1984 to provide Internet-wide translation of computer names into IP addresses to allow the continuous growth of the Internet. Due to its exposed and central role the DNS is constantly targeted by hackers.

Common attacks against the DNS aim to manipulate DNS data in order to redirect traffic through hacker controlled infrastructure. Usually referred to as man-in-the-middle attacks, they allow the hacker to eavesdrop and record session traffic usually without detection. Once a hacker gains control and successfully can manipulate the DNS data his options are virtually unlimited.

Attacks on the DNS infrastructure happens on a daily basis but the hijacking attacks exposed in early 2019 were of a much larger scale and with an unprecedented success rate. These attacks went unnoticed for two full years before being detected and exposed. This is undeniable evidence of the skill level the hackers of today possess. Read more about the attacks in our article DNS Hijacking campaign revisited.

The sheer magnitude of these attacks, their success rate and the implications that followed compelled the American agency DHS CISA to issue its first ever Emergency Directive (ED 19-01) requiring all US agencies to complete four mitigating actions within ten business days! The first item on that list was to audit and validate every DNS resource record on every authoritative name server!

No matter how many and how effective you think your security countermeasures are, continuous validation of your DNS resource records is invaluable and probably the only way to find out if your DNS infrastructure is being hijacked.