Recent events1,2 have shown the threat of domain hijacking is very real; however, it is also largely
preventable. As Verisign previously noted3,
there are many security controls that registrants can utilize to help
strengthen their security posture. Verisign would like to reiterate this advice
within the context of the recent domain hijacking reports.
Domains are an
important element of internet infrastructure; their functionality and security rely
upon many factors such as their delegated name servers. Name server delegations
introduce complex and subtle inter-dependencies between domains and their
authoritative name servers. Compromise of any name server in the delegation
hierarchy can lead to a potential hijacking scenario. Targeted name server compromises
in the delegation hierarchy can facilitate a complete hijack of a domain or set
of domains, while name server compromises deeper in the delegation hierarchy
may result in partial hijacking, since not all name servers in the hierarchy
are involved in every DNS resolution request. A compromised name server is
capable of diverting DNS requests to malicious servers controlled by threat
actors and can be weaponized for phishing attacks or other nefarious purposes.
Over the past several weeks, security professionals have issued reports1, 2 about the hijacking of various domains via their name server delegations. These changes were likely made using compromised registrar credentials and are believed to be backed by a foreign nation state entity1, 2. During the attacks, the threat actors used the traffic directed to their infrastructure to launch spear phishing campaigns against various government entities in northern Africa and the Middle East. These targeted spear phishing attempts were facilitated by the transitive trust4 placed on the compromised domains and their delegated name servers.
Several of the compromised domains contained hosts that were specified as name servers for numerous top-level domains (TLDs) including country code TLDs5 in the northern African and Middle East regions. Subsequently, DNS traffic resolution for corresponding reliant zones were partially/completely routed to the threat actors’ infrastructure. This redirection of DNS traffic facilitated their ability to target specific government and industry entities in the targeted countries. While the domains did not employ a domain locking tool, some were DNSSEC6 signed, which helped mitigate the attack for resolving parties that perform validation.
As part of the response to this incident, the Department of Homeland Security issued Emergency Directive 19-017 requiring federal civilian agencies to address the risks presented by this activity. The order mandated four actions to be taken: 1) Audit DNS records, 2) Change DNS account passwords, 3) Add multi-factor authentication to DNS accounts and 4) Monitor Certificate Transparency logs.
Verisign is engaged with various industry and government entities regarding this incident and has provided technical insights into the DNS ecosystem regarding the complex mechanisms and system-to-system interactions/dependencies involved. To date, there is no evidence that the scope of compromise extends beyond the sets of credentials at various registrars.
Verisign
encourages registrants to research their registrar’s security offerings and to
take advantage of the tools and services they offer. Techniques such as locking
services offered by registrars and registries8, two-factor
authentication, password strengthening, and other common security hygiene
practices9 are all best practice security
recommendations that Verisign encourages and promotes.
Additional security recommendations are available in the following ICANN
SSAC reports:
- SAC04010:
“Measures to Protect Domain Name Registration Service Against Exploitation or
Misuse”
- SAC04411:
“A Registrant’s Guide to Protecting Domain Name Registration Accounts”
- SAC07412:
“Best Practices for Preserving Security and Stability in the Credential
Management Lifecycle”
