The U.K. National Cyber Security Centre (NCSC) urged organizations to implement measures to mitigate the threat of DNS hijacking.
The agency published the alert after it discovered multiple attacks attempting to exploit the Domain Name System (DNS) over the last few months. One of the largest of these hijacking campaigns occurred in January, when threat actors compromised credentials to alter DNS records. This attack enabled the malefactors to redirect web traffic for commercial and government organizations worldwide, particularly those in the Middle East, to infrastructure under their control.
Following this campaign, NCSC witnessed several other attempts at DNS hijacking across multiple regions and sectors for the purpose of creating malicious DNS records, obtaining SSL certificates, conducting transparent proxying and/or hijacking domains. The tips in the agency’s report are meant to help organizations defend themselves against such attacks.
DNS Hijacking Activity Surges
NCSC’s disclosure came amid a surge of DNS hijacking activity. In November 2018, Cisco Talos detected an attack campaign in which bad actors used malware called DNSpionage to redirect traffic going to Lebanon and the United Arab Emirates (UAE) using .gov domains, as well as a Lebanese airline company.
Several months later, IXIA observed a DNS hijacking campaign that exploited consumer-grade routers to skim user input data for PayPal, Netflix, Gmail and Uber. Cisco Talos spotted the Sea Turtle threat actor updating its own hijacking campaigns with new infrastructure earlier this month, and Avast recently detected close to 200,000 hijacking attempts targeting Brazilians since February 2019.
Mitigate the Threat of DNS Hijacking
Security professionals can help defend their organizations against DNS hijacking by monitoring access to web applications and authentication logs for web traffic that could be coming from a single or small pool of web-facing IP addresses. It’s also critical to prioritize vulnerability remediation by gaining insight into all assets and components used in the network.