US-CERT- AA19-024A: DNS Infrastructure Hijacking Campaign

[Netwörkheäd]

AA19-024A: DNS Infrastructure Hijacking Campaign

[html]Original release date: January 24, 2019

          

Summary

          

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised credentials, an attacker can modify the location to which an organization's domain name resources resolve. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization's domain names, enabling man-in-the-middle attacks.

See the following links for downloadable copies of open-source

[icecream-guy]

access to your DNS should not be provided for externally.   If One Insists:

1. audit DNS Records
2. change DNS account passwords
3. add multi-factor authentication for DNS accounts

[deanwebb]

access to your DNS should not be provided for externally.   If One Insists:

1. audit DNS Records
2. change DNS account passwords
3. add multi-factor authentication for DNS accounts

^ VERY TRUTH.