February 7, 2019
DNS and MFA – WST
On January 22, 2019, the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive with the subject, “Mitigate DNS Infrastructure Tampering” ordering all federal agencies to secure login credentials for their internet domain records. Required actions include auditing DNS records, changing DNS account passwords, adding multi-factor authentication to DNS accounts, and monitoring certificate transparency logs to detect prior unauthorized certificate issuance. This directive was issued in response to an uptick in attacks on websites and email servers by altering DNS records.
CISA Director Christopher C. Krebs wrote in the emergency directive:
“Using the following techniques, attackers have redirected and intercepted web and mail traffic, and could do so for other networked services:
1. The attacker begins by compromising user credentials, or obtaining them through alternate means, of an account that can make changes to DNS records.
2. Next, the attacker alters DNS records, like Address (A), Mail Exchanger (MX), or Name Server (NS) records, replacing the legitimate address of a service with an address the attacker controls. This enables them to direct user traffic to their own infrastructure for manipulation or inspection before passing it on to the legitimate service, should they choose. This creates a risk that persists beyond the period of traffic redirection.
3. Because the attacker can set DNS record values, they can also obtain valid encryption certificates for an organization’s domain names. This allows the redirected traffic to be decrypted, exposing any user-submitted data. Since the certificate is valid for the domain, end users receive no error warnings.
To address the significant and imminent risks to agency information and information systems presented by this activity, this emergency directive requires the following near-term actions to mitigate risks from undiscovered tampering, enable agencies to prevent illegitimate DNS activity for their domains, and detect unauthorized certificates.”
While this directive was aimed at federal agencies, all institutions should heed this warning and secure access to their public DNS account with multi-factor authentication.