1. DNS/Alert

Contents

DNS/Alert

https://www.us-cert.gov/ncas/alerts/AA19-024A　　/emargency-directive-19-01

https://knagayama.hatenablog.com/blog/2019/01/29/CISA/　(日本語;　私訳)

日本語記事に間違いが多いので、読みなおしておく。https://news.mynavi.jp/article/20190128-761698/

「DNSハイジャックが広範囲で展開中」　/link-mynavi

JPRSはいつもとは異なり、訳さない。 https://jprs.jp/tech/security/2019-01-28-cisa-emergency-directive.html

DNS Infrastructure Hijacking Campaign Original release date: January 24, 2019

JPRSはなぜ日本語訳をださないのか。

/FireEyeの記事を読め： Global DNS Hijacking Campaign: DNS Record Manipulation at Scale January 09, 2019 | by Muks Hirani, Sarah Jones, Ben Read https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html

1.1. Summary

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign.

Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolve.

This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks.

(globalを広範囲と訳したようだが、)　(DNSサーバーを乗取ったという話はない)

1.2. Technical Details

Using the following techniques, attackers have redirected and intercepted web and mail traffic, and could do so for other networked services.

The attacker begins by compromising user credentials, or obtaining them through alternate means, of an account that can make changes to DNS records.

Next, the attacker alters DNS records, like Address (A), Mail Exchanger (MX), or Name Server (NS) records, replacing the legitimate address of a service with an address the attacker controls. This enables them to direct user traffic to their own infrastructure for manipulation or inspection before passing it on to the legitimate service, should they choose. This creates a risk that persists beyond the period of traffic redirection.

Because the attacker can set DNS record values, they can also obtain valid encryption certificates for an organization’s domain names. This allows the redirected traffic to be decrypted, exposing any user-submitted data. Since the certificate is valid for the domain, end users receive no error warnings.

1.3. Mitigations

NCCIC recommends the following best practices to help safeguard networks against this threat:

Update the passwords for all accounts that can change organizations’ DNS records.
    
Implement multifactor authentication on domain registrar accounts, 
or on other systems used to modify DNS records.

Audit public DNS records to verify they are resolving to the intended location.

Search for encryption certificates related to domains and revoke any fraudulently requested certificates.

マイナビニュースにあった訳(間違いが多い)

 .   組織のDNSサポートを変更することができるすべてのアカウントのパスワードを更新する
 .   DNSレポートを変更できるアカウントやドメイン登録を実施したアカウントに関して多要素認証を導入する
 .   パブリックDNSサポートを監査して名前解決が適切に実施しているかどうかを確認する
 .   ドメインに関する証明書を検索し、不正に利用された証明書をすべて取り消す