DNS Loophole Let Researchers Intercept Dynamic DNS Traffic from 15,000 Organizations
Summary
Researchers found that registering specially named zones with managed DNS providers could redirect Windows dynamic DNS traffic, exposing internal network details. Amazon and Google fixed the issue; other providers may remain vulnerable.
Key points
- Researchers said the loophole exposed dynamic DNS traffic from more than 15,000 organizations and millions of devices, including Fortune 500 companies and government agencies.
- They registered hosted zones named after shared DNS name servers on AWS Route 53, then directed the zones to an IP address they controlled.
- Windows machines attempting dynamic DNS updates could send internal IP addresses, computer names, employee names, locations, and domain details to the researchers’ server.
- The researchers said they could not determine whether anyone had exploited the issue before their discovery, and that other providers might still be vulnerable.
- Amazon and Google fixed the issue, according to the article.
- Microsoft told the researchers it viewed the behavior as a known misconfiguration involving external DNS resolvers, rather than a vulnerability.
- The article advises organizations to configure DNS resolvers so dynamic DNS updates do not leave internal networks.
Article Details
- Attack Vectors
- Registering a hosted zone with the same name as a managed DNS provider's name server broke tenant isolation and redirected some dynamic DNS queries to an IP address controlled by the researchers.
- Windows machines attempting dynamic DNS updates queried the hijacked name server, leaking internal IP addresses, computer names, employee names, and office locations.
- Defensive Notes
- Configure DNS resolvers so dynamic DNS updates do not leave the internal network.
- Managed DNS providers can verify domain ownership before allowing customers to register domains.
- The article reports that Amazon and Google fixed the issue; other managed DNS providers may remain vulnerable.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 1[.]3[.]3[.]7 | IP address the researchers say they configured as the destination for leaked dynamic DNS traffic. |
MITRE ATT&CK
People
Vendors
AmazonToday the rise of managed DNS providers (like Amazon Route53, Google Cloud DNS, and Akamai, to name just a few) and the ubiquity of remote work are stretching and tearing new holes in the fabric of this decades-oldGoogleToday the rise of managed DNS providers (like Amazon Route53, Google Cloud DNS, and Akamai, to name just a few) and the ubiquity of remote work are stretching and tearing new holes in the fabric of this decades-oldMicrosoftThe short answer is that Microsoft machines use a unique algorithm to find and update the master DNS server on IP address changes. Eventually the algorithm will query the hijacked nameserver for its own address. The
Products
AWS Route 53AWS Route 53 has around 2,000 DNS servers that are used and shared among all their customers. We registered a new domain on the Route53 platform with the same name as their official DNS server. (Technically, we createdGoogle Cloud DNSToday the rise of managed DNS providers (like Amazon Route53, Google Cloud DNS, and Akamai, to name just a few) and the ubiquity of remote work are stretching and tearing new holes in the fabric of this decades-old
Countries
IranA major commodity trading company had employees working in the Ivory Coast and Myanmar, and a subsidiary of a large credit union with a branch in Iran.Ivory CoastA major commodity trading company had employees working in the Ivory Coast and Myanmar, and a subsidiary of a large credit union with a branch in Iran.MyanmarA major commodity trading company had employees working in the Ivory Coast and Myanmar, and a subsidiary of a large credit union with a branch in Iran.