Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
6/1/2017
11:00 AM
Raymond Pompon
Raymond Pompon
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

DNS Is Still the Achilles’ Heel of the Internet

Domain Name Services is too important to do without, so we better make sure it's reliable and incorruptible

Domain Name Services (DNS) is too important to do without, but it’s difficult to defend. This makes DNS services an excellent target for attack. Taking out an organization’s DNS service renders it unreachable to the rest of the world except by IP address. If  "f5.com" failed to be published online, every single Internet site and service we ran would be invisible. This means web servers, VPNs, mail services—everything.

Even worse, if hackers could change the DNS records, they could then redirect everyone to sites they controlled. Since DNS is built upon cooperation between millions of servers and clients over insecure and unreliable protocols, it is uniquely vulnerable to disruption, subversion, and hijacking. Here’s a quick rundown of the known major DNS attacks.

Denial of Service
Denial-of-service attacks are not limited to DNS, but taking out DNS decapitates an organization. Why bother flooding thousands of web sites when killing a single service does it all for you? The most famous DoS attack against DNS are the recent Dyn DDoS attacks which exceeded 40 gigabytes of noise blared at their DNS services. Dyn was running DNS services for many major organizations, so when they were drowned by a flood of illegitmate packets, so were companies like Amazon, Reddit, FiveThirtyEight, and Visa.

DNS can also be subverted for use as a denial-of-service weapon against other sites by way of DNS Amplification/Reflection. This works because DNS almost always returns a larger set of data than what it was queried. Since DNS runs over UDP, it’s a simple matter for attackers to craft fake packets spoofing a query source, so if they can fake thousands of queries from the victim’s IP address whose amplified responses will overwhelm the victim.

A DNS amplification attack floods the victim's server with a tsunami of fake requests. 
Image Source: F5
A DNS amplification attack floods the victim’s server with a tsunami of fake requests.
Image Source: F5

DNS Hijacking
Who owns what domain name, and what DNS servers are designated to answer queries are both managed by Domain Registrars. These are commercial services, such as GoDaddy, eNom, and Network Solutions Inc., where there are registered accounts controlling pointers to DNS servers. If attackers can hack those accounts, they can repoint a domain to a DNS server they control. This is how a Brazilian Internet banking site was completely taken over for hours.

DNS Server Vulnerabilities
Because DNS services are software, they can contain bugs that attackers can exploit. Luckily, DNS is old (so we’ve had time to find most of the bugs) and simple (so bugs are easy to spot), but problems have cropped up. In 2015, there was a rather significant hole found in BIND, an open-source DNS server running much of the Internet. Called CVE-2015-5477 (no cute name, thank you), BIND allowed an attacker to crash a DNS server with a single crafted query.

Another software vulnerability in DNS servers is the recursive DNS spoof cache poisoning technique, which means that an attacker can temporarily change DNS database entries by issuing specifically crafted queries.

Unauthorized DNS Changes
If you’ve got a server, someone must manage it. That means that you are dependent on how strongly you are authenticating the admins to that server, as well as ensuring the trustworthiness and competence of those admins. Because of the nature of DNS records, changes to DNS are cached by query clients; bad entries can sometimes take hours or days to unwind across the Internet.

DNS Data Leakage
You can’t run an unauthenticated Internet database full of important information without the occasional risk of leaking out something important. Attackers will query DNS servers looking for interesting Internet services that may not be widely known. DNS records can also aid phishing expeditions by using known server names in their phony baloney emails.

Many organizations run DNS on the inside of the network, advertising local resources for workstations. Some smaller organizations run split-horizon DNS servers that both DNS services to the world, as well as the inside network. A wrong configuration on that DNS server can lead to some devastating DNS data leakages as internal names and addresses are shared with attackers.

DNS Man-in-the-Middle
The easily spoofed protocol UDP that DNS uses is a weak link. An attacker inline between the victim and the DNS server they’re querying can intercept and monkey with DNS queries. It’s a pretty easy attack to pull off if you’re on the same wire or wireless as the victim or DNS server. An F5 researcher found a way to use it to steal Microsoft Outlook credentials. So, it’s an attack that shouldn’t be taken lightly.

Bottom line: We are stuck with DNS, so better make sure it’s reliable and incorruptible. The future of the Internet depends on it.

Get the latest application threat intelligence from F5 Labs.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...
CVE-2019-18889
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.