A DNS hijacking wave is targeting companies at an almost unprecedented scale
1–10 of 104 posts
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#2The "clever trick" seems to be:
previously compromised the login credentials for the administration panel of the target’s DNS provider
or
previously compromised domain registrar or ccTLD
Unless I'm missing something, given either of those things, doesn't take much cleverness...
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#3What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#4"One DNS hijacking technique involves changing what’s known as the DNS A record."
Could be any record, depends on the intentions of the hijacker. Typically we see web traffic being hijacked to another ipv4 host which indeed, is an A record. Another abuse option could be to alter SPF/DKIM to do a more sophisticated phishing campaign.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#5What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
Deprecated/killed.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#6The "clever trick" seems to be: previously compromised the login credentials for the administration panel of the target’s DNS provider or previously compromised domain registrar or ccTLD Unless I'm missing something, given either of those things, doesn't take much cleverness...
It's some kind of alarmism over letsencrypt ... "letsencrypt will give tricky attackers a valid certificate for a domain!!!" (if they get control over the domain) (... certs have almost always been granted based on control of the domain, though historically it mostly MX records ... so attackers could do pretty much the same thing 15 years ago)
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#7Note that these attacks involve compromised accounts with authority servers, so despite being the most visible and impactful DNS attacks of the last few years, DNSSEC would have done little to defend against them; in fact, even in the DNSSEC fantasy-world where DANE replaces X.509 CAs, these attackers would still have accomplished their goals.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#8What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
Deprecated/killed. https://www.chromestatus.com/feature/5903385005916160
If you're confused as to why, this article was illuminating: https://scotthelme.co.uk/using-security-features-to-do-bad-t...
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#9Note that these attacks involve compromised accounts with authority servers , so despite being the most visible and impactful DNS attacks of the last few years, DNSSEC would have done little to defend against them; in fact, even in the DNSSEC fantasy-world where DANE replaces X.509 CAs, these attackers would still have accomplished their goals.
DNSSEC has the unique advantage of permitting offline signing. If you go this route, even somebody controlling your authoritative servers wouldn't be able to modify your records.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#10Could this be a big setback for "Let's Encrypt" since it uses DNS resolution for its own authentication instead of being a second factor?