Iran Suspected of 'Stealthy & Sophisticated' DNS Hijacking Campaign

Iran seems to have been conducting the Mother of All DNS Hijackings over the last year, according to new research from FireEye.

In its report, researchers describe a year-long DNS hijacking campaign that was equally stealthy and sophisticated. The hijacking has affected dozens of domains belonging to government, telecommunications and Internet infrastructure entities across the Middle East and North Africa, as well as Europe and North America.

While there is no direct attribution to Iran available, FireEye has identified access from Iranian IPs to machines used to intercept, record and forward network traffic. They note that geolocation of an IP address is a "weak" indicator, but that these IP addresses have been previously observed during the response to an intrusion attributed to Iranian cyberespionage actors.

The report notes that researchers have "moderate" confidence that the hijacking has been conducted by persons based in Iran and that -- more importantly for attribution purposes -- the activity aligns with Iranian government interests.

(Source: iStock)

The first method exploited by the attackers is altering DNS A records. This misdirects mail traffic to the listening post set up by the attacker on a load balancer. Credentials are extracted and stored on the rogue load balancer.

A second method used is to modify the DNS NS records after hacking into the victim's domain registrar account. The name server record will give the correct IP for a web request that is made, but it will forward any mail requests to the attackers' listening post. The username, password and domain credentials are harvested and stored, then the mail request is sent to the correct IP.

Let's Encrypt certificates are used to avoid setting off alarms when the information is redirected.

A DNS redirector and previously altered A and NS records form a third method that is also used by the attackers. Requests from outside the affected domain go to the correct mail server, but requests from inside the domain go to the listening post.

One of the FireEye report writers sounded the alarm on Twitter, noting that the attacks and scope were "huge."

The researchers recommend that two-factor authentication for DNS and TLD management accounts should be enabled. They also note that that IT and security admins should be alert for any changes made to DNS A or NS records.

Google is also taking some steps that may aid in combatting DNS hijacking, but it is only currently implemented for Android 9 Pie systems.

The search giant's DNS resolver is, according to the company, "the world's largest public Domain Name Service (DNS) recursive resolver." Googlers are adding the DNS-over-TLS protocol, which specifies a standard way to provide security and privacy for DNS traffic between users and their resolvers. It uses TLS, which is the same technology that is in use to protect HTTPS web connections.

Google is also implementing the RFC 7766 recommendations, which can minimize the overhead of using TLS. These include support for TLS 1.3 -- for faster connections and improved security -- TCP fast open, and the pipelining of multiple queries and out-of-order responses over a single connection. (See OpenSSL 1.1.1 Released With TLS 1.3 Support.)

DNS hijacking has proven to be a stubborn security problem. Increased awareness by security teams of the depth of the problem, along with improved support by Google and others, will go a long way in resolving it.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.