DNS Threats part 2: Hijacking
The goal of a Hijacking attack is similar to that of a cache poisoning attack. However, where the cache poisoning attack can only infect a small set of resolvers, the Hijacking attack targets and infects the source, the authoritative DNS servers. By changing DNS records at the source, thousands of resolvers can spread the corrupt record, making successful DNS hijacking attacks substantially more dangerous.
When the DNS Hijacking campaign was exposed in 2019, it stirred up a lot of noise in the security community. The threat was so imminent and nasty that the DHS CISA had to issue its first-ever Security Directive, forcing all US agencies to manually audit every public DNS entry.
It took the top Internet security experts two years to discover the 2019 DNS Hijacking campaign. Even worse, the victims of many of these hijacks were government and military security agencies. Let that sink in a while!
Luckily, this attack helped expose the existence of APT groups and the threats they pose to a broader audience. The major difference between these APT groups and a more “ordinary” hacker is that they work with a purpose and will not be deterred if their attacks are discovered. They will only regroup and attack you again.
These groups are known to use various techniques in their attacks, ranging from low-tech attacks like Email spamming and social engineering to advanced techniques like spear phishing and zero-day exploits to (among other things) plant malware to record and report account information, which is further exploited.
It’s no longer a battle to fend off certain types of attacks; you have to be ready for everything they can throw at you because they will!
Since 2019, DNS Hijacking has carved out a nasty niche in the history of DNS security. Today, several different attacks use Hijacking in their descriptions. Although there are similarities between them, this article will highlight what sets them apart.
Domain hijacking
A domain hijacking is when an attacker transfers a domain’s ownership and assigns it to its own controlled name servers. Once a transfer is completed, the attacker will fully control your domain and its content.
To initiate a domain transfer, the attacker must have gained access to the target’s registrar account or otherwise convinced or tricked the account holder to initiate the transfer. Once initiated, the attacker only has to accept the transfer on its own account to complete it.
Since domain hijackings became an obvious threat, many registrars now provide services to help protect accounts and domains against unintentional domain transfers. Services like MFA, or Multi-Factor Authentication, are often required nowadays and can usually be activated for free. MFA is a great way to improve the security of any account and should be used wherever possible!
Other services might be available, like domain lock, where MFA is required for certain changes, or multi-level domain locks, where both the registrar and the TLD registry need to unlock the domain before critical updates are accepted. Some of these services may cost additional money, but it could very well be money well spent to avoid having your domains hijacked.
Of course, your registrar can help you get your domain back if it has been hijacked. Unfortunately, this process usually takes some time, and your organisation or brand might suffer in the meantime.
DNS hijacking
DNS Hijacking is when a threat actor covertly gains and keeps administrative access to a DNS with one ore more domains, which allows him to modify any domain content at will. Gaining access to a master server is obviously the ultimate goal but even access to slave servers can cause enough harm. Keep in mind that an attacker won’t stop when a hijacking is completed. They have only started.
By controlling the domain content the threat actor can redirect traffic to their own servers by either impersonating the original server or even worse create a Man-In-The-Middle attack. A Man-In-The-Middle attack is when traffic is redirected through a system controlled by the threat actor (much like how a proxy server works) usually to covertly collect information, ranging everywhere from user account information, bank accounts, credit cards and all the way to nation state secrets.
To make these types of attacks work without suspicion, the attacker would need a certificate, which can be obtained for free at Let’s Encrypt. This can easily be accomplish by manipulating the domains’ CAA records to allow other Certificate Authorities to issue new certificates. And since the attacker controls the domain information the certificate validation record can be placed in the zone to complete the process. This does not stop only with web services; VPN connections over HTTPS could also be at risk.
Other useful MITM attacks include manipulating MX and mail host records to redirect both email and mail client traffic. To give an idea of what an attacker could achieve, most smartphones connect and authenticate every 5 minutes to update their mailboxes.
Eventually, an accomplished DNS admin would realise that some records have been modified if left for long enough. To mitigate the risk of discovery, attackers keep the manipulating record active only for a short time, like an hour, before changing it back to the original, but long enough to poison the caches of resolvers and clients.
The scenarios above are only a few variants of how a skilled attacker would work with a hijacked DNS and its domains.
So, what attack methods do the attackers use to gain this level of access?
This kind of access is rarely gained by a single attack but is the result of many different attacks over a period of time. As stated earlier in this article, hacker groups, whoever they might be, usually use different methods and techniques over time to probe for and collect information, where each piece of information is used to take the next step to gain even more information.
Sometimes they are able to discover bugs in protocols and use them to their advantage, like the bug in the EEP protocol, which allowed them to inject false IP addresses to existing DNS servers during domain registrations.
If a skilled attacker can gain this level of control and keep it hidden from the real domain owners, it can pose a threat for a long time. Just imagine the magnitude of data that may have been stolen during the 2019 DNS Hijacking campaign against the Middle Eastern authorities.
Subdomain hijacking
Many organisations use outsourced services for countless reasons. Some of these services are only used for a short period of time, like during a market campaign or similar. These services are usually referred to from the organisation’s DNS servers by A/AAAA or CNAME records. Once a service has fulfilled its purpose, it is usually shut down at the service provider.
It is remarkably common that organisations fail to remove the DNS record when such services are shut down, leaving it dangling. By mining zone content, hackers look for these dangling records to exploit. By requesting the same hostname, the hacker can now set up a new host service with the appearance of a legitimate corporate site.
Subdomain hijacking attacks have increased steadily over the past few years. They are relatively easy to execute, and if executed correctly, the risk of detection is very low. The impact can be very rewarding for the attacker.
Stepping up DNS housekeeping
In large organisations, the number of external DNS entries can be counted in the hundreds and maybe thousands. The truth is that very few organisations keep track of every external DNS entry, making it easy for cybercriminals to exploit.
Remember the DHA CISA emergency directive from 2019 (ED 2019-01)? One of the four mitigating actions in the list was to audit every external DNS record, ensuring there were no dangling records and every IP address was to be accounted for.
This must be done regularly if we are to counter these types of attacks! For large organisations, this can be a tough task, but by assigning ownership of each record and making it a part of regular internal audits, it could very well be accomplished!