DNS Typos Could Let Attackers Abuse U.S. Government Email Systems
Summary
A study of more than 25,000 government-related domains found dozens with mistyped or expired DNS references that could enable email abuse or expose security data. The researcher recommends DNS inventories, audits and registering misspelled domains.
Key points
- Alex Shakhov found dozens of government-related domains with DNS records pointing to mistyped, expired or repurposed domains.
- Typos in email-provider references for Pikeville and Livingston County could let non-Amazon entities send email on their behalf. Pikeville's official domain is listed on URIBL.
- Livingston County's SPF include list rotated every three to eight days from 2021, which Shakhov said suggested a snowshoe operation; the article says this does not prove the domain was abused.
- A malicious actor acquired a domain referenced by the City of Rupert's DNS, changed its name-server records to point to a gambling site, and arranged to send and receive email using that domain.
- Shakhov found 11 local government institutions at risk of exposure through DMARC reporting domains, including four county and law-enforcement agencies in Jennings County, Indiana.
- Across millions of domains scanned, 47% of unregistered domains found in SPF and DMARC records were typos, according to Shakhov.
- Recommended measures include mapping DNS records and their origins, avoiding manual entry, conducting regular DNS audits and registering misspelled versions of official domains.
Article Details
- Event Type
- Study of government-domain DNS misconfigurations that may expose organizations to email impersonation, abuse of DNS records, and disclosure of email-security information.
- Impact
- The study found dozens of vulnerable domains among more than 25,000 government-related domains. Misconfigured records could let attackers send or receive email on behalf of agencies, alter DNS records, or collect DMARC reports. The article reports that Pikeville's domain was listed on URIBL and that its researcher considered ongoing abuse of that domain reasonable to assume; it says the evidence did not prove the extent of abuse involving Livingston County.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amasonses[.]com | Typo domain in Pikeville's SPF record that reportedly allowed a non-Amazon entity to send email on its behalf. |
| DOMAIN | amzonses[.]com | Typo domain in Livingston County's SPF record that reportedly allowed a non-Amazon entity to send email on its behalf. |
| DOMAIN | heyburnidaho[.]org | The article says a malicious actor purchased this domain, changed its name-server records to point to a gambling website, and arranged to send and receive email using its addresses. |