Subscribe to Officer's Blog
>4.5K subscribers
The most important thing to understand here is the path of the cyber attack – its vector. Let's take a closer look at DNS Hijacking...
https://officercia.mirror.xyz/fYQegsuZkdLPlhW9xopFzwnLmQWjaaWBjnR2qX9UixY
Below you will see not a typical article, but a systematization of knowledge - SoK, in which I will rely on authors that I myself trust in this matter, and at the end I will write my conclusions.
Many thanks to Authors, thank you for your amazing works! Special thanks to: Halborn, Hacken, Efani & Bitcoin.com!
For educational purposes only, the Author won't be responsible for any damage done!
DNS is the “address book of the Internet.” It translates human-readable domain names to the IP addresses used by computers for routing network traffic (like 127.0.0.1).
A DNS server hierarchy organizes the DNS infrastructure. Each server in the hierarchy will answer to requests for the IP addresses associated with a specific domain name, allowing a user to find any domain on the Internet using only single top-level DNS server.
According to Halborn, DNS hijacking occurs when the records stored on DNS servers are compromised by an attacker. If an attacker can replace a legitimate DNS record with one containing their IP address, any future DNS lookups will result in the visitor going to the wrong site.
While it's a possible vector, attacking websites with a HTTPS connection is much harder than simply changing the IP. The attacker would need to use self-signed certs which would trigger your browser, or other methods, possibly socially engineering some CA to register a new certificate for the website they are trying to impersonate. Keep this in mind!
On March 15, 2021, Cream and Pancakeswap were victims of DNS hijacking. What exactly is DNS hijacking? Cybersecurity agency Halborn explains.
With all said, hackers can achieve DNS hijacking in different ways. Judging from the Hacken's article, here are the most popular:
This DNS hijacking method involves hackers overriding and reconfiguring the DNS settings of a vulnerable DNS router (a hardware device used by domain service providers to link their domain names to equivalent IP addresses) to launch a DNS attack. Afterwards, the attackers would jam the website and redirect traffic to another malicious website, making the website inaccessible to users.
This is accomplished by hackers interfering with the communication between a network user and a DNS server in order to obstruct such communication and eventually redirect the user to an unknown destination IP address leading to malicious websites. DNS spoofing is another term for it.
An attacker compromises the DNS server, alters its saved records, and redirects subsequent DNS requests to malicious websites owned by them.
This DNS hijacking technique is accomplished when a cybercriminal installs Trojan malware on the computer of a website user. This malware is designed to look like legitimate software.
Once activated, it grants hackers access to network systems, allowing attackers to steal data and alter DNS settings to redirect users to fake websites. Sometimes it involves reverse-proxy phishing even - to copy the original website.
During the last two weeks, you probably started to hear more frequently about DNS hijacking. In this article, we will define what DNS hijacking is and how to prevent it. Let's start by understanding what DNS is and its importance.
As stated by Efani, Mobile carriers manage their DNS platform to control the user experience, and it produces a lot of data for them:
https://officercia.mirror.xyz/0tlSSF2LDTOnnMN41R5Uc1kTpo-G-kXljn8pT0a1YLY
https://officercia.mirror.xyz/aN6giRkUsNd0o0bmjZVeZb2htkO_Ve16gMsARU6RBfM
DNS makes using the Internet a lot easier to use by not having to remember a website domain rather than IP addresses, and companies can change their IP address if under attack, but threats to DNS include the following;
Malware can manipulate the DNS cache on your device
Intercept DNS requests between you and the cellular network
The DNS platform can also get hacked
The hacker can hack the WIFI router you are using as well.
All these methods had used to achieve the same result, to send you to a rogue web asset.
Assume you want to go to Binance, and your DNS request is hijacked and directed to a fake page where you enter your login credentials. While trying to figure out why you can't log in, the hacker has already collected your login information.
Hackers use this to gather login credentials, collect information about your device, and serve malware to hack you in the future - these refer to as Phishing. Or they serve you ads to generate ad revenue; this is called Pharming.
DNS attacks can manifest themselves in many ways, all targeted against the Domain Name System that connects the internet. When you're interacting in the cryptocurrency space, here are a few ways to protect yourself against DNS attacks.
Pages loading slowly;
Ads popping up even where they shouldn't be;
Pop-ups convincing the user that their PC is infected with malware (suggest using the one from malwarebytes).
It is also possible to recognize DNS Hijacking with a couple of simple steps:
Ping the domain you are trying to visit. If the results show that the IP address does not exist, everything is fine - your DNS has not been hijacked.
Check your router settings through the admin page. If the DNS settings have been changed, you can start sounding the alarm.
Use the WhoIsMyDNS tool, which will show you the server answering DNS queries for your site. If the DNS presented is unfamiliar to you, you may have already been attacked.
Use Registry-Lock status. It protects domains from unwanted changes, transfers and deletions, thereby making it very difficult for hackers.
Prevent cache poisoning by randomizing user identity, using randomized query IDs, and using random source ports.
Another high priority is to monitor your certificates and the certificates used by all your «hot» domains. A proper certificate monitoring solution (SIEM/DLP/Bandwidth Monitor) would have noticed that a certificate was changed for the webmail portal, alerting you to the unauthorized change. You can still do this manually.
Spoofing, unlike hijacking, does not forcibly disconnect the victim site from the network in order to start an attack. Instead, the hacker changes the DNS information to redirect the user to a malicious website.
Furthermore, by poisoning the DNS cache, the attacker exploits a vulnerability in the DNS configuration/settings. If a server does not check DNS responses (e.g., DNSSEC), it will cache erroneous answers locally and use them to respond to subsequent users who issued the same query.
Sites such as Whoismydns.com enable web users to check whether they recognize the name and IP of the server they’re connecting to, which will often be your ISP. Beyond that, unfortunately, there is little that the average web user can do, for the onus is on web admins to monitor their site for evidence of BGP leaks…
According to Doug Madory, Despite proposed technical fixes to secure BGP and DNS, it would appear that we presently have no way to completely prevent this from happening again.
However, an idea worth considering comes from Job Snijders of NTT who proposes that major DNS authoritative services offer RPKI for origin validation of their routes. This would enable ASes and IXP route servers to drop invalid routes like the ones used to impersonate Amazon’s DNS a while ago…
I am also not asking you to comply with all of the tips from this article, but you must remember the main rule in this particular case:
If we finally want to give people the opportunity to be their own bank, we must realize that in this case, people must be able to replace all those services and actions for which traditional banks get money.
Yes, it seems like it is a veritable minefield over there. Keep the faith. Learn the latest attack techniques, white hat cheat sheets, and defenses.
Only knowledge can defeat criminals’ knowledge. In this intellectual boxing match the most prepared wins, and we want that to be you!
therecord.media/two-cryptocurrency-portals-are-experiencing-a-dns-hijack-at-the-same-time
medium.com/oracledevs/bgp-hijack-of-amazon-dns-to-steal-crypto-currency-a90dd29cb3ab
medium.com/oracledevs/bgp-hijack-of-amazon-dns-to-steal-crypto-currency-a90dd29cb3ab
news.bitcoin.com/how-to-protect-yourself-against-dns-attacks-when-using-cryptocurrency
coindesk.com/tech/2022/07/01/two-polygon-fantom-front-ends-hit-by-dns-attack
cryptopotato.com/dns-hijack-compromised-ankrs-services-for-polygon-and-fantom
crypto-economy.com/dns-attacks-and-cryptocurrencies-how-to-protect-ourselves
quora.com/Is-DNS-hijacking-attack-a-threat-to-cryptocurrency
From IP to transport and beyond: cross-layer attacks against applications
A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques
Use Chains to Block DNS Attacks: A Trusty Blockchain-based Domain Name System
medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600
kentik.com/blog/bgp-hijacks-targeting-cryptocurrency-services
theverge.com/2018/4/24/17275982/myetherwallet-hack-bgp-dns-hijacking-stolen-ethereum
digicert.com/blog/digicert-funds-research-for-auto-detecting-dns-attacks-at-scale
techbeacon.com/security/bgp-hijack-steals-aws-ip-range-cryptocurrency-theft-ensues
researchgate.net/publication/317919489_Hijacking_Bitcoin_Routing_Attacks_on_Cryptocurrencies
Also check out this awesome MVP for security from ToB!
Support is very important to me, with it I can do what I love — educating users!
If you want to support my work, you can send me a donation to the address:
SupportMe. Contribute to OffcierCia/support development by creating an account on GitHub.
0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A or officercia.eth — ETH, BSC, Polygon, Optimism, Zk, Fantom, etc
4AhpUrDtfVSWZMJcRMJkZoPwDSdVG6puYBE3ajQABQo6T533cVvx5vJRc5fX7sktJe67mXu1CcDmr7orn1CrGrqsT3ptfds — Monero XMR
Officer's Blog
No comments yet