For centuries, we've relied on maps as a way to navigate our world.
And more recently we've become highly dependent on GPS to
help drive our cars and navigate treacherous waters.
What if those maps and GPS satellites were suddenly unavailable?
Or even worse, intentionally changed to provide erroneous information.
Welcome to another episode of Cautionary Tales from the Dark Side,
where we delve into some infamous case files and see just what lessons they
have to teach us. In today's tale,
we'll be exploring a vulnerability found in the internet equivalent
of GPS domain name services.
This is Codename Nautilus.
[Inaudible].
Domain Name Service,
or DNS as it's known is a common internet service that allows us to use
recognizable and memorable domain names, instead of cryptic numeric,
IP addresses to locate and validate websites,
email addresses, and many other resources.
DNS has been around since the very early days of the internet and lies at the
heart of modern networks everywhere. However,
like most technologies of the early internet,
it was never designed to accommodate the scale we face today.
And unfortunately,
any disruption can cause enormous ramifications.
In 2008 security researcher,
Dan Kaminsky was as he puts it playing around with
DNS, when he stumbled upon something unsettling.
DNS servers work by forming a sort of hierarchy network among themselves.
If your local DNS doesn't know the address of a given domain name,
it will consult the next DNS server up in the hierarchy until a
so-called authoritative DNS response is found for that domain
name. Now to make things more efficient,
your local DNS will hold that authoritative response and memory or a period
of time called caching.
Kaminsky had figured out a way to trick most DNS servers into remembering
responses that did not come from the authoritative DNS for a given
domain. Using this vulnerability,
someone could redirect traffic destined to a legitimate domain to some
alternative locations.
Stealing information and identities in the process all without the
victim being any the wiser.
Kaminsky knew the seriousness of what he had just uncovered and called an urgent
meeting of DNS vendor representatives to share his findings.
Kaminsky publicly announced his findings on the same day that most DNS vendors
released fixes for this vulnerability urging organizations who
have DNS servers to apply the upgrades.
He'd intended to give everyone 30 days to address the issue,
but details of the exploit had been leaked after only 13 days
leaving any unpatched servers vulnerable.
These kinds of attacks don't necessarily trigger all the warning bells in your
monitoring system. So it's hard to know just what impact there might have been.
But do know that almost every organization was and still is
vulnerable to DNS based attacks.
The global DNS threat report for 2020 estimates organizations are exposed to
nine various DNS based attacks per year.
When DNS outages take place, applications can quickly fail.
With the average time to mitigate a DNS attack being over five hours,
that's a long time for an outage.
Financial losses can easily run into the millions of dollars not to mention the
reputational damage. In some cases,
businesses have suffered permanent damage and have been forced to close.
So how can we defend ourselves against DNS attacks?
First through regular patching critical security patches are a vital for
any system, including DNS servers. Those organizations,
which quickly headed the warning by Kaminsky to patch their DNS servers were in
considerably better position for doing so.
Irregular patching process is a good first line of defense.
You might also consider migrating your DNS servers to a cloud-based
solution like AWS Route 53, or Azure DNS,
where patching is done automatically. Second,
we can harden our DNS servers.
Hardening is a process of updating configuration and tightening controls on the
server to make it more secure and more resistant to
unauthorized access.
DNS was never designed to withstand the kind of attacks we see in the 21st
century.
So spending extra time securing our DNS servers have helped avoid
many vulnerabilities. Next we can audit our DNS zones.
Zones are collections of DNS records and for those zones that we're
responsible for, it makes sense to keep them tidy and up to date.
We can also consider adopting DNS Sec.
DNS Sec is an additional layer of security on top of traditional DNS
lookups that allows us to validate responses we get from other DNS
servers as truly authentic using cryptographic signatures.
Not every DNS provider supports DNS sec, but if yours does,
it might be worth a look.
Finally be open to cooperation with other organizations in the
event of a DNS exploit because DNS attacks can have far reaching
implications beyond our own sphere of control,
cooperation and information sharing often help accelerate resolution.
Although DNS has been around since 1984,
it's still a favorite attack vector because of its ubiquity and relative
simplicity. Even after all these years,
many considered DNS as the Achilles heel of the internet.
I'm Scott Pletcher, and this has been Cautionary Tales from the Dark Side.
For more
Cautionary Tales, consider subscribing notifications,
or just a thumbs up.
Leave a comment to report other cases we should investigate.
The people deserve to know.