Last week’s DHS “alert” upgraded to “an emergency directive”

By Richard Arneson

Last week, the US Department of Homeland Security (DHS) issued an alert through its US-CERT (Computer Emergency Readiness Team) division concerning repeated DNS hijacking attacks. Apparently, the alert was well deserved. Yesterday, it was significantly upgraded to an emergency directive due to a spate of recent DNS hijacking incidents that have originated in Iran.

Last week’s alert was due to a recent report published by FireEye, a California-based cybersecurity firm. In it, they provided details concerning a coordinated hacking campaign led by an Iranian cyber-espionage group that had manipulated DNS records for both government agencies and private enterprises.

The hijackers’ end game? Redirect traffic meant for email servers to malicious clones, after which they’ll scan for and gather treasured login credentials.

The Directive

The DHS emergency directive orders all government agencies to carefully audit its DNS records and look for unauthorized changes, especially any related to passwords. And it directs them to enable multi-factor authentication for those accounts that can be managed through DNS records.

In addition, they urge all IT personnel to monitor Certificate Transparency (CT) for recently-issued TLS certificates used for government domains. Also, to pay special attention to any requested by non-government employees.

How does DNS Hijacking work?

In the simplest of definitions, DNS hijacking is simply a means of redirecting traffic to a phony website. As a quick refresher, DNS was invented to translate complex, impossible-to-memorize IP addresses into something that’s far easier to remember (like, for instance, GDT.com—much easier to commit to memory than nine (9) numbers listed in no intuitive, commonsensical order).

When you type in a website’s name, the DNS is called on to direct traffic to its corresponding IP address. Usually your ISP maintains the DNS servers, and if a hacker can crack into them, let the hijacking hijinks begin. From there, they can change victims’ DNS records to point traffic toward their servers. Then their party starts. They capture as much login information as they can stomach.

Who has been affected by the attack?

Currently, the DHS, according to a report published by Cyberscoop, a multimedia provider of cybersecurity-related news and information, is aware of six (6) civilian organizations that have fallen victim to this particular DNS hijacking attack. What the DNS doesn’t know yet is how many government agencies have been affected. In its directive, they outlined a four-step action plan to address the issue. All government agencies have been given ten (10) business days to complete it.

Security Concerns?

To find out how to secure your organization’s network and mission critical data, contact GDT’s tenured and talented engineers and security analysts at SOC@GDT.com. From their Security and Network Operations Centers, they manage, monitor and protect the networks of companies of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.

If you want more information about network security, check out the following articles:

The Collection #1 data breach—sit down first; the numbers are pretty scary

Shutdown affects more than workers

DDoS Attacks will deny a Massachusetts Man Ten (10) years of Freedom

Phishing for Apples

This isn’t fake news

Don’t get blinded by binge-watching

Mo Money, Mo Technology―Taylor Swift uses facial recognition at concerts

Step aside all ye crimes—there’s a new king in town

Q & A for a Q & A website: Quora, what happened?

They were discovered on Google Play, but this is no game

And in this corner…

Elections are in, but there’s one (1) tally that remains to be counted

Hiring A Hacker Probably Shouldn’t Be Part of Your Business Plan

Gen V

Sexy, yes, but potentially dangerous

Tetration—you should know its meaning

It’s in their DNA

When SOC plays second fiddle to NOC, you could be in for an expensive tune

How to protect against Ransomware