DNS Hijack – Simplifying The Misroute

DNS Hijacks are rapidly getting common and threat to e-commerce, corporates and end users. What exactly is a DNS hijack and how does that work and most importantly, how should we safeguard against this rapidly increasing threat.

- Archie Jackson

The hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies, including targets in Albania, Cyprus, Egypt, Iraq, Jordan, Kuwait, Lebanon, Libya, Saudi Arabia and the United Arab Emirates.

For example, the passive DNS data shows the attackers were able to hijack the DNS records for mail.gov.ae, which handles email for government offices of the United Arab Emirates. Here are just a few other interesting assets successfully compromised in this cyber espionage campaign: -nsa.gov.iq: the National Security Advisory of Iraq -webmail.mofa.gov.ae: email for the United Arab Emirates’ Ministry of Foreign Affairs -shish.gov.al: the State Intelligence Service of Albania -mail.mfa.gov.eg: mail server for Egypt’s Ministry of Foreign Affairs -mod.gov.eg: Egyptian Ministry of Defense -embassy.ly: Embassy of Libya -owa.e-albania.al: the Outlook Web Access portal for the e-government portal of Albania -mail.dgca.gov.kw: email server for Kuwait’s Civil Aviation Bureau-gid.gov.jo: Jordan’s General Intelligence Directorate

-adpvpn.adpolice.gov.ae: VPN service for the Abu Dhabi Police

-mail.asp.gov.al: email for Albanian State Police

-owa.gov.cy: MicrosoftOutlook Web Access for Government of Cyprus

-webmail.finance.gov.lb: email for Lebanon Ministry of Finance

-mail.petroleum.gov.eg: Egyptian Ministry of Petroleum

-mail.cyta.com.cy:Cyta telecommunications and Internet provider, Cyprus

-mail.mea.com.lb: email access for Middle East Airlines

WHAT EXACTLY IS A DNS?

The domain name system (DNS) functions as an interpreter between humans, who talk words, and computers, who talk numbers.