Psst, Your DNS is Showing: Uncovering Vulnerabilities in DNS and Password Managers.

The Domain Name System (DNS) is often likened to the internet’s phone book, translating human-friendly domain names into IP addresses that computers use to identify each other on the network. While this system is fundamental to the functioning of the internet, it also presents a critical vulnerability that cybercriminals are increasingly exploiting. This article delves into how DNS is being used as a vector for phishing attacks and how these vulnerabilities can be leveraged to compromise even the most secure password managers.

The Weak Link: DNS and Its Role in Cybersecurity

DNS is inherently trusting. When a user types a domain name into their browser, the DNS system takes it on faith that the requestor is legitimate and directs them to the corresponding IP address. This openness, while essential for the seamless operation of the internet, creates an attack surface that can be manipulated by bad actors. One of the most common attacks that exploit DNS is DNS spoofing or cache poisoning. In these attacks, the attacker corrupts the DNS cache, causing the DNS server to return an incorrect IP address. As a result, users are unknowingly redirected to malicious websites that can be used to steal credentials or distribute malware.

I can see your DNS from here.

The success of any attack begins with great reconnaissance. After a cyber-criminal determines their target, they will need to conduct a thorough reconnaissance of external assets. The more the attacker knows, the better the chances of success. One such method is DNS reconnaissance. DNS reconnaissance discovers hosts related to a domain. One such tool is known as DNSDumpster. DNSdumpster is a free online tool that provides information about a target's domain name system (DNS) configuration. DNSdumpster can be an extremely useful resource for conducting initial reconnaissance and gathering information about a target's network and systems.

An example of a real-world use case is a cyber-criminal group KILLNET using DNSDumpster for reconnaissance. Killnet is a pro-Russia hacker group known for its DoS (denial of service) and DDoS (distributed denial of service) attacks towards government institutions and private companies in several countries during the 2022 Russian invasion of Ukraine.

Spoof went the DNS.

Another attack method for DNS is “Spoofing”. Domain spoofing is when cyber criminals fake a website name or email domain to try to fool users. The goal of domain spoofing is to trick a user into interacting with a malicious email or a phishing website as if it were legitimate. Domain spoofing is like a con artist who shows someone fake credentials to gain their trust before taking advantage of them. Domain spoofing is often used in phishing attacks. The goal of a phishing attack is to steal personal information, such as account login credentials or credit card details, to trick the victim into sending money to the attacker or to trick a user into downloading malware. Domain spoofing can also be used to carry out ad fraud by tricking advertisers into paying for ads shown on websites other than the websites they think they're paying for.

One such tool that helps cyber-criminals is dnstwister. Dnstwister is used to find lookalike domains that adversaries can use to attack you. Dnstwister can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence.

Dnstwister can be a useful tool for cybersecurity professionals to assist against DNS attacks, but there is a dark side as well. Dnstwister will reveal potential DNS attack methods for your domain, but it will also show the cyber-criminal available domains that can be used to attack your domain. It’s nothing that is new to the cybersecurity world but another known issue with DNS.

One password to rule them all, one password to find them, one password to bring them all and in the DNS expose them.

Password managers are meant to protect your passwords for multiple applications. This creates ease and is supposed to make things secure for the user. It’s all protected with one master password…to unlock them all. In most cases, the password manager is protected by MFA to ensure proper security.

What if a cyber-criminal was conducting DNS reconnaissance and was able to verify what password manager you were using? It sounds crazy..or is it? If you notice from the screenshot below, during DNS reconnaissance, among all the information, we see a case where a company has DNS entries for a password manager called 1Password.

A cyber-criminal can utilize this information and conduct a phishing attack, posing as 1Password, to gain the user's master password. The cyber-criminal will be able to access all the passwords the user has. 1Password also has a login page that can accessed from anywhere at any time. The security is solely setup by the company that uses the 1Password product. Hopefully, it is set up correctly to alert on brute force attempts and has proper MFA mechanisms.

Mitigation Strategies: How to Protect Yourself

Protecting against DNS-based attacks requires a multi-layered approach:

1. Use DNSSEC: DNS Security Extensions (DNSSEC) add a layer of authentication to DNS requests, ensuring that the responses received are actually from the intended source and have not been tampered with.
2. Regularly Monitor DNS Records: Organizations should routinely audit their DNS records to detect any unauthorized changes. Automated tools can help identify anomalies in DNS traffic that may indicate an attack.
3. Educate Users: Users should be educated about the risks of phishing and how to recognize the signs of a spoofed website. This includes checking the URL carefully and being cautious of unsolicited emails.
4. Deploy Advanced Anti-Phishing Solutions: Modern security tools use machine learning to detect and block phishing attempts before they reach the user. These tools can analyze DNS traffic patterns and identify anomalies that may indicate an ongoing attack.
5. Ensure Password Manager Security: Use password managers that support DNSSEC and other security measures to reduce the risk of DNS spoofing. Users should also disable the autofill feature in their password manager to add an extra layer of manual verification.

While DNS is an essential component of the internet’s infrastructure, its vulnerabilities are increasingly being targeted by cybercriminals to facilitate phishing attacks and compromise even the most secure password managers. By understanding the risks and implementing robust security measures, individuals and organizations can better protect themselves from these sophisticated attacks. Remember, in the world of cybersecurity, even something as seemingly innocuous as a DNS request can have far-reaching consequences. So, next time you browse the web, ask yourself: Is your DNS showing?