RE: A Deep Dive on the Recent Widespread DNS Hijacking

["Keith Medcalf" <kmedcalf () dessus com>]

Obviously none of y'all read the report.  Here is the relevant quote:

""""
DNSSEC protects applications from using forged or manipulated DNS data, by requiring that all DNS queries for a given 
domain or set of domains be digitally signed. In DNSSEC, if a name server determines that the address record for a 
given domain has not been modified in transit, it resolves the domain and lets the user visit the site. If, however, 
that record has been modified in some way or doesn’t match the domain requested, the name server blocks the user from 
reaching the fraudulent address.

While DNSSEC can be an effective tool for mitigating attacks such as those launched by DNSpionage, only about 20 
percent of the world’s major networks and Web sites have enabled it, according to measurements gathered by APNIC, the 
regional Internet address registry for the Asia-Pacific region.

Jogbäck said Netnod’s infrastructure suffered three separate attacks from the DNSpionage attackers. The first two 
occurred in a two-week window between Dec. 14, 2018 and Jan. 2, 2019, and targeted company servers that were not 
protected by DNSSEC.

However, he said the third attack between Dec. 29 and Jan. 2 targeted Netnod infrastructure that was protected by 
DNSSEC and serving its own internal email network. Yet, because the attackers already had access to its registrar’s 
systems, they were able to briefly disable that safeguard — or at least long enough to obtain SSL certificates for two 
of Netnod’s email servers.

Jogbäck told KrebsOnSecurity that once the attackers had those certificates, they re-enabled DNSSEC for the company’s 
targeted servers while apparently preparing to launch the second stage of the attack — diverting traffic flowing 
through its mail servers to machines the attackers controlled. But Jogbäck said that for whatever reason, the attackers 
neglected to use their unauthorized access to its registrar to disable DNSSEC before later attempting to siphon 
Internet traffic.

“Luckily for us, they forgot to remove that when they launched their man-in-the-middle attack,” he said. “If they had 
been more skilled they would have removed DNSSEC on the domain, which they could have done.”
"""

If you manage to get access to the change the dns delegation at the parent you can also turn DNSSEC off.  Clearly the 
scripties managed to do this once but "forgot" to do it the second time around ... That they also "forgot" to disable 
DNSSEC on PCH is not particularly relevant.  It only goes to prove my point that DNSSEC is irrelevant and only gives a 
false sense of security (for this particular attack vector).  I suppose you could have really long timeouts on your DS 
records, but that would merely "complicate" matters for the scripties and would not be protective ...


---
The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.

> -----Original Message-----
> From: Montgomery, Douglas (Fed) [mailto:dougm () nist gov]
> Sent: Sunday, 24 February, 2019 15:38
> To: nanog () nanog org
> Cc: kmedcalf () dessus com
> Subject: RE: A Deep Dive on the Recent Widespread DNS Hijacking
>
> You might have missed reading the very article you cite.
>
> "Woodcock said PCH’s reliance on DNSSEC almost completely blocked
> that attack, but that it managed to snare email credentials for two
> employees who were traveling at the time.
> ....
> Aside from that, DNSSEC saved us from being really, thoroughly
> owned.”
>
>
>
> Or maybe ACME .. https://tools.ietf.org/html/draft-ietf-acme-acme-
> 12#section-11.2
>
> "It is therefore RECOMMENDED that ACME-based CAs make all DNS queries
> via DNSSEC-validating stub or recursive resolvers.  This provides
> additional protection to domains which choose to make use of DNSSEC.”
>
> I am not sure how many of the domains listed as being hijacked are
> DNSSEC signed, but it seems if they were, and had a reasonable long
> TTL on a DS record at their parent, many if not most of these could
> have been prevented/detected.
>
> ICANN seems to think that is the case: ICANN Calls for Full DNSSEC
> Deployment
> https://www.icann.org/news/announcement-2019-02-22-en
>
> Of course, DNSSEC is often blamed for not protecting those who did
> not deploy/use it.  Not sure what can be said about that line of
> reasoning.
>
> Dougm
> --
> Doug Montgomery, Manager Internet  & Scalable Systems Research @ NIST
>
>
>
> ============
>    Date: Sat, 23 Feb 2019 12:13:41 -0700
>    From: "Keith Medcalf" <kmedcalf () dessus com>
>    To: "nanog () nanog org" <nanog () nanog org>
>    Subject: RE: A Deep Dive on the Recent Widespread DNS Hijacking
>       Attacks
>    Message-ID: <6e31d305aee69c4d85116e6a81d0c91d () mail dessus com>
>    Content-Type: text/plain; charset="us-ascii"
>
>    On Saturday, 23 February, 2019 10:03, Stephane Bortzmeyer wrote:
>
>    >Very good article, very detailed, with a lot of technical
> precisions,
>    >about the recent domain name hijackings (not using the DNS, just
> good
>    >old hijackings at registrar or hoster).
>
>    >https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-
> widespread-dns-hijacking-attacks/
>
>    So in other words this was just an old school script kiddie
> taking advantage of DNS registrars, the only difference being this
> was a whole whack of script kiddies acting in concert directed by a
> not-quite-so-stupid script kiddie, with some "modernz" thrown in for
> good measure.  (Sounds like an NSA operation to me -- and the targets
> perfectly match those that the NSA would choose -- plus some good old
> misdirection just for the jollies of it)
>
>    The second takeaway being that DNSSEC is useless in preventing
> such an occurrence because the script kiddies can merely turn it off
> at the same time as they redirect DNS.  However, having DNSSEC can
> protect you from incompetent script-kiddies.  It can also give you a
> false sense of security.
>
>    Did I miss anything?
>
>    ---
>    The fact that there's a Highway to Hell but only a Stairway to
> Heaven says a lot about anticipated traffic volume.