IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

DNS loophole could allow hackers to carry out “nation-state level spying”

Sensitive data could be accessed from corporate networks using vulnerability

Letters DNS displayed on a blue high tech background

Security researchers have discovered a flaw within major DNS-as-a-Service (DNSaaS) providers that could allow hackers to access confidential data within corporate networks.

Shir Tamari and Ami Luttwak, researchers at cyber security firm Wiz, found a loophole that allowed them to intercept a portion of worldwide dynamic DNS traffic going through managed DNS providers like Amazon and Google.

“Essentially, we “wiretapped” the internal network traffic of 15,000 organizations (including Fortune 500 companies and government agencies) and millions of devices,” said Tamari.

“It was a bottomless well of valuable intel - computer names, employee names and locations, and details about organizations’ web domains including entry points that are exposed to the internet.”

He added that there is no way of knowing whether hackers have already exploited the loophole and collected data undetected for over a decade. Leaked information from the flaw can contain internal and external IP addresses, computer names, and, sometimes, NTLM / Kerberos tickets.

“The root cause of the problem is the non-standard implementation of DNS resolvers that, when coupled with specific unintended edge cases on the DNS service provider's side, cause major information leakage from internal corporate networks,” said Tamari. 

In a presentation at this year’s Black Hat conference in Las Vegas, researchers showed how Microsoft Windows endpoints revealed sensitive customer information when performing DNS update queries.

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastFree download

“The security risk is high. If an organization's DNS Updates are leaked to a malicious 3rd party, they reveal sensitive network information that can be used to map the organization and make operational goals,” added the researchers.

Internal IP addresses reveal the organization’s network segments; computer names hint at the potential content they may hold; external IP addresses expose geographical locations and the organization's sites throughout the world; and internal IPv6 addresses are sometimes accessible from the outside and allow an entry point into the organization, according to researchers.

“The impact is huge. Out of six major DNSaaS providers we examined, three were vulnerable to nameserver registration,” said Tamari.

Researchers added that any cloud provider, domain registrar, and website host who provides DNSaaS could be vulnerable. Tamari said that while two major DNS providers (Amazon and Google) have fixed the issue, others may still be vulnerable. “As a result, millions of devices are potentially vulnerable,” he said.

Featured Resources

Join the 90% of enterprises accelerating to the cloud

Business transformation through digital modernisation

Free Download

Delivering on demand: Momentum builds toward flexible IT

A modern digital workplace strategy

Free download

Modernise the workforce experience

Actionable insights and an optimised experience for both IT and end users

Free Download

The digital workplace roadmap

A leader's guide to strategy and success

Free Download

Recommended

Solve cyber resilience challenges with storage solutions
Whitepaper

Solve cyber resilience challenges with storage solutions

4 Jul 2022
Storage's role in addressing the challenges of ensuring cyber resilience
Whitepaper

Storage's role in addressing the challenges of ensuring cyber resilience

4 Jul 2022
Introducing IBM Security QRadar XDR
Whitepaper

Introducing IBM Security QRadar XDR

4 Jul 2022
The Total Economic Impact™ of IBM Security MaaS360 with Watson
Whitepaper

The Total Economic Impact™ of IBM Security MaaS360 with Watson

4 Jul 2022

Most Popular

Universities are fighting a cyber security war on multiple fronts
cyber security

Universities are fighting a cyber security war on multiple fronts

4 Jul 2022
Hackers claim to steal personal data of over a billion people in China
data breaches

Hackers claim to steal personal data of over a billion people in China

4 Jul 2022
Latest LockBit ransomware strain 'strikingly similar' to BlackMatter
ransomware

Latest LockBit ransomware strain 'strikingly similar' to BlackMatter

4 Jul 2022