Just recently, a new DNS spoofing attack was reported to be putting millions of devices at risk. This threat involves two popular C standard libraries that support DNS operations such as lookups and the translation of domain names to IP addresses. Although the impact of this attack is yet to be determined, security experts warn that this should be taken seriously, as it affects the products of major network device makers including Axis, Netgear, and Linksys. It also has the potential to create problems for Linux distros, including Embedded Gentoo and the router OS OpenWRT.
Spoofing attacks are widely used by cybercriminals to harm targets in a number of ways. They can redirect website visitors to rogue servers, overload servers, introduce malware to devices, or steal login credentials and other data. Downplaying these threats can lead to serious consequences.
Growing need for DNS security
The bad: DNS attacks will only get worse. The good: DNS security is within reach for all kinds of organizations. DNS protection is not complex, even for those who have just heard about the term. With the right cybersecurity solution, it is not difficult to address various cyber threats that target the domain name system.
According to IDC’s 2021 DNS Security Survey, nearly all, at 99 percent, of organizations have some form of DDS security. However, 87 percent or an overwhelming majority of businesses have experienced DNS attacks on their apps and services. The survey indicates that each attack costs nearly $1 million on average.
DNS tunneling, DDoS, and other related attacks have been around for some time. There have been solutions developed to address these threats. However, threat actors have evolved their attacks and managed to take advantage of DNS weaknesses that emerge with the increased adoption of cloud services and infrastructure. Many organizations fail to implement changes in their security posture in response to the changes in their IT infrastructure and resources.
It is also not uncommon for network administrators, SysAdmins, and DevOps to forget or spend minimal time and effort on DNS protection. They tend to focus more on database systems, web servers, SSH services, and other popular resources.
As mentioned, DNS attacks vary and have different impacts on organizations. However, the biggest adverse consequence of DNS attacks is the availability of websites or web services. Attacks like DDoS cause websites to suffer downtimes, disrupting business operations and causing serious losses. At a time when most businesses go online to serve customers or undertake transactions, downtimes are unforgivable. It only makes sense to invest in a good DNS protection solution.
Preferred DNS protection
How do organizations achieve DNS protection? There are many ways. These include the auditing of DNS zones, updating DNS servers, hiding the BIND version, restricting zone transfers, disabling DNS recursion, and implementing multifactor authentication. It also helps to use isolated DNS servers and a DDoS mitigation provider.
However, it is advantageous to use a dedicated DNS protection solution. Going back to the IDC DNS Security Survey, one notable finding indicated is that misconfigurations and oversight can happen when the DNS protection approaches used by organizations are not comprehensive and unified. These configuration and oversight issues can create opportunities for threat actors that target DNS. Similarly, VM IP addresses that have been forgotten or unaccounted for can become vulnerabilities that enable successful DNS attacks that particularly target organizations with complex IT infrastructure.
It is likely that the reason many still encounter DNS attacks (87 percent) despite the fact that virtually all (99 percent) use DNS defense measures is the lack of sufficient threat coverage. The IDC study reveals that some 42 percent are not using a dedicated DNS security solution. Not all organizations have the experienced IT team to effectively and routinely examine everything to prevent and mitigate DNS attacks. It helps to have a meticulously designed system to address DNS threats.
Comprehensive DNS protection solutions enable high-security visibility with readily available DNS traffic stats and trends, attack analytics, and instant attack notifications. They also facilitate precise mitigation, especially when it comes to DDoS by using reputation and rating-based heuristics in evaluating queries and blocking malicious packets.
Threats that can be prevented on the DNS level
There are many cyber threats that can be prevented by paying attention to DNS security. Top examples of which are as follows:
- Cache or DNS poisoning – This entails the corruption of a DNS server, undertaken by redirecting traffic to a malicious website through the replacement of a legitimate IP address in the server’s cache. It leads to the installation of malware, user credential theft, and data theft.
- DoS and DDoS – These common cyberattacks aimed at disrupting website or web service availability are preventable by putting in place a solid DNS protection solution. Many security providers offer dedicated DDoS solutions, but organizations can also turn to DNS protection to address these threats.
- Zero-day attacks – These can mean a variety of attacks anchored on vulnerabilities discovered by threat actors in the DNS server software or the DNS protocol stack. The spoofing attack mentioned in the introduction is an example of zero-day DNS attacks.
- DNS amplification – In this attack, the perpetrators make use of a DNS server that allows recursive lookups to spread an attack to other DNS servers. They exploit a misconfigured DNS server to use it in undertaking a widespread DDoS attack.
- Fast-flux DNS – This DNS attack technique is not the actual damaging blow a threat actor deals with an organization. It is mostly a way to hide (behind quickly shifting compromised hosts) botnets that are used to achieve some other form of cybercrime, such as the distribution of malware and phishing.
Addressing these threats with an effective DNS protection solution can help organizations boost their security posture significantly. DNS is a crucial attack surface, but it is also an important starting point for cybersecurity. Plugging vulnerabilities in it and putting in place the right security controls can greatly improve cybersecurity.
In conclusion
The global DNS security market is projected to grow at a CAGR of 9.8 percent for the period 2021 to 2028. It is set to become a $2.3 billion market in six years. It is a sub-industry that is not as big as other cybersecurity sub-sectors, but it is something worth paying attention to.
DNS attacks are not trivial threats. They can be precursors to more serious attacks or they can cause major adverse outcomes themselves. What’s great about the current cybersecurity landscape right now is that there are many readily available solutions to effectively address DNS threats and prevent a host of serious cyber problems.
