DNS On Fire
summary
Two campaigns hijack DNS for espionage: DNSpanache starts with LinkedIn spearphishing that delivers a macro which downloads a loader that uses DNS C2 via encoded A records and HTTP for config and exfil (debug logs leak clear command output); researchers see ~95 DNS redirections and >25 domain takeovers across two years targeting VPN and mail servers in the Middle East. Sea Turtle compromises registries/registrars (Netnod, Packet Clearing House), swaps name servers, generates or steals certs and even private keys to perform transparent MITM on government infrastructure using toolkits like web-masks + Squid/ICAP.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:14Paul Rascagneres
- 1:50Warren Mercer
- 2:20Agenda - We do have one!
- 3:42Brief Introduction to DNS
- 4:25DNS Records - Chain of Custody Many Potential Points of Attack for a Domain's DNS Records
- 5:12DNS Redirection Attacks No lack of threat actor capability
- 7:20Infection Vectors
- 20:41DNS Redirection 2 years of activities
- 22:11Oilrig leak
- 28:41The Sea Turtle Primary Objectives Oil & Gas
- 30:34Victimology Mapping
- 30:58Registrar vs Registry vs Registrant
- 42:10Protection Against DNS Compromise 2 Factor Authentication
- 42:49Protection Against DNS Compromise Patch Patch and Patch Again
related talks
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
32mDNS as Added Security Against Ransomware Attacks
26mMisuse of DNS, the Second Most Used Protocol
34mThe SolarWinds Supply Chain Compromise
25mDark Side of the DNS Force
32mSomething’s Phishy: See the Hook Before the Bait
43mBlock DNS exfiltration with dnsmasq proxy
34mPractical Steps for Reducing Exposure and Detecting Compromise