DNS hijacking: protect the account behind your domain
Attackers redirected government domains by logging into DNS accounts. A US emergency directive lists four steps anyone can take.
Researchers have been tracking a campaign that hijacks organisations’ DNS: attackers log into the account that manages a domain’s records, point mail or web traffic to their own servers, get valid certificates, and quietly collect passwords. Last week the US government issued an emergency directive telling agencies to act.
The four steps it lists are good for every company:
- Check your DNS records on every domain. Are they pointing where you expect?
- Change the passwords on accounts that can change DNS: registrar, DNS host, and anything with API access.
- Turn on MFA for those accounts.
- Monitor certificate transparency logs for certificates issued for your domains that you didn’t request.
Whoever controls your DNS can read your email and impersonate your website. That account deserves the same protection as your bank.