Forest Global Training Partners

Cyber Risks · Krebs on Security

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Summary: Between late 2018 and early 2019, hackers suspected of being Iranian hijacked DNS records for more than 50 Middle Eastern companies and government agencies across Albania, Cyprus, Egypt, Iraq, Jordan, Kuwait, Lebanon, Libya, Saudi Arabia and the UAE, redirecting email and VPN traffic to attacker-controlled servers in Europe. The attackers obtained SSL certificates from Comodo and Let's Encrypt for the targeted domains, and reached key infrastructure providers Netnod and Packet Clearing House by stealing credentials used to send EPP commands through registrars Key-Systems and Frobbit.se.

Bottom line: The campaign reached Netnod, which operates one of the 13 root name servers, and PCH, which manages DNS for more than 500 top-level domains - and both were vocal DNSSEC adopters, yet only about 20 percent of the world's major networks and Web sites have enabled it.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related