Category Archives: DNS Hijacking

DNS hacks are attacks on critical infrastructure, senior U.S. diplomat says

Posted on by

Any nation-state behind recent hijackings of Domain Name System (DNS) records should, in theory, be held responsible under the latest cyberwarfare norms agreement made by 20 countries at the UN in 2015, says America’s top cyber diplomat. “One of the norms is disrupting physical infrastructure providing services to the public, and I think that fully encapsulates the internet’s DNS function,” Amb. Robert Strayer told CyberScoop Tuesday on the sidelines of the Atlantic Council’s International Conference on Cyber Engagement. The 2015 UN agreement, outlined in a Group of Government Experts (GGE), affirms that nation-states shouldn’t launch cyberattacks that intend to damage critical infrastructure in other countries. The DNS — which translates human-readable domain names of websites to their machine-readable versions — has a crucial role in directing internet traffic. But subsequent UN talks reportedly fell apart in 2017 over disagreements China and Russia had with the rest of the member states about whether further enhancements to the GGE document would impinge on their right to self-defense in […]

The post DNS hacks are attacks on critical infrastructure, senior U.S. diplomat says appeared first on CyberScoop.

Continue reading DNS hacks are attacks on critical infrastructure, senior U.S. diplomat says→

PayPal, Netflix, Gmail, and Uber Users among Targets in New Wave of DNS Hijacking Attacks

Posted on by

Since March 29, 2019, Ixia’s Application and Threat Intelligence (ATI) center has been tracking the latest malicious campaign against consumer-grade routers. Today, April 5th, we captured a new wave of attacks that use a different DNS server. The… Continue reading PayPal, Netflix, Gmail, and Uber Users among Targets in New Wave of DNS Hijacking Attacks→

Ongoing state-sponsored DNS hijacking campaign has compromised 40 entities

Posted on by

Hackers backed by a nation-state have successfully hijacked Domain Name System records to steal credentials from approximately 40 public and private entities across 13 countries in an attack that’s lasted for about two years, which Cisco’s Talos research team has dubbed “Sea Turtle” in research published Wednesday. The ongoing attack targets intelligence agencies, military organizations, and energy firms, as well as foreign ministries, telecommunications companies, and internet service providers. Cisco’s researchers characterize the attackers as “highly capable” and “unusually brazen,” but don’t go so far as to identify what country may be behind the attack. FireEye has indicated Iran is likely responsible for an attack that appears similar, but which Cisco claims is distinct from this new campaign. DNS hijacking allows hackers to gain credentials from victim entities in order to control the target’s DNS records — without flagging to the victims that they’re under attack. Using the DNS records, attackers are capable of […]

The post Ongoing state-sponsored DNS hijacking campaign has compromised 40 entities appeared first on CyberScoop.

Continue reading Ongoing state-sponsored DNS hijacking campaign has compromised 40 entities→

Missed DNS Flag Day? It’s Not Too Late to Upgrade Your Domain Security

Posted on by

Whether or not you plan on using DNS cookies or DNSSEC, foreseeing an upgrade plan for your software to the latest version made available as part of DNS Flag Day is highly advised.

The post Missed DNS Flag Day? It’s Not Too Late to Upgrade Your Domain Security appeared first on Security Intelligence.

Continue reading Missed DNS Flag Day? It’s Not Too Late to Upgrade Your Domain Security→

US gov declares emergency after wave of domain hijacking attacks

Posted on by

The US Department of Homeland Security (DHS) has issued an emergency directive tightening DNS security after a recent wave of domain hijacking attacks targeting government websites. Continue reading US gov declares emergency after wave of domain hijacking attacks→

Rep. Langevin: We need a DHS briefing to understand extent of DNS hijacking threat

Posted on by

A key House Democrat wants the Department of Homeland Security to brief lawmakers “as soon as possible” on a new domain name system hacking threat to federal computer networks, and the emergency order the department issued in response. DHS should brief members of the House Homeland Security Committee on the cyberthreat because “we need to understand the scope of this action and how many agencies were actually affected,” Rep. Jim Langevin, D-R.I., said in an interview Wednesday. Langevin was reacting to a rare emergency directive that DHS issued Tuesday ordering civilian agencies to tighten security controls in the face of a suspected Iranian hacking campaign. DHS issued the order out of concern that civilian agencies could be vulnerable to cyberattacks on platforms for managing domain name system (DNS) records, which help ensure that a computer user reaches an intended website. By manipulating DNS records, hackers could direct unwitting users to malicious websites. At least […]

The post Rep. Langevin: We need a DHS briefing to understand extent of DNS hijacking threat appeared first on CyberScoop.

Continue reading Rep. Langevin: We need a DHS briefing to understand extent of DNS hijacking threat→