Thwart DNS Hijackers: 5 Tips

Domain name system attacks hit The New York Times and Twitter hard last month. Here are five ways to make your DNS records harder to hack and easier to recover if theyre compromised.

In light of the recent domain name system (DNS)
hijacking attacks
on
The New York Times
, Twitter and Huffington Post, its important for CIOs to take a closer look at their DNS security strategy -- and to be able to respond quickly if their company is attacked.
DNS records are basically sets of instructions that help connect your website to the outside world. The following five practices make these records harder to hijack and easier to recover if they are compromised, thereby reducing the damage attackers can cause. When DNS records are hijacked, a company must be able to get them back as quickly as possible because once the malicious records hit the caching servers, it becomes much harder to undo the damage.
1. Use best practices for credentials that allow changes to be made to DNS records.
Your whole service is only as secure as the security of the password to your DNS registrant account. Ensure that access to accounts used to update DNS records is limited to as few people in your organization as possible. Make sure to use hard-to-guess passwords, and avoid reusing passwords at all costs.
[ Heres why you shouldnt buy Android apps from off-brand sites. Read
Hack 99% Of Android Devices: Big Vulnerability
. ]
2. Revisit the choice of DNS provider regularly as you grow.
Many companies, particularly start-ups, frequently choose DNS registrants and DNS service providers based on a combination of their pricing and the ease of setup and use. Sometimes that means the DNS provider doesnt have much information about the owner other than a username and password used to identify the account. In cases of
social engineering attacks
or compromised passwords, it might be hard to reclaim the domain.
As companies grow, they should revisit their choice of provider every few months to make sure that its capable of handling the level of security the company needs. Popular and high-profile services might be targeted by hackers with agendas -- and not every provider is capable of handling the heat that comes with popularity.
3. Make use of SSL certificates.
DNS hijacking can effectively be used to perform
man-in-the-middle
(MITM) attacks. In a MITM attack, the attacker diverts the user to a malicious server he controls. The malicious server then sends the users request to the original server and sends the servers response back to the user. This setup allows the attacker to steal the information being passed back and forth, inject malicious content into responses before sending them back to the user, or both.
This is one of the highest risks associated with DNS hijacking and can cause a lot of damage in the form of stolen credentials and injection of malicious content.
To arm yourself, enforce validation of SSL/TLS certificates and use certificate pinning in mobile apps and rich clients. Certificate validation means the attacker must get a certificate tied to the stolen domain before being able to carry out the MITM attack. Pinning certificates in mobile and rich clients will take this restriction even further by ensuring the attacker will need access to the pinned certificates private keys before being able to carry out the attack. This will reduce the risk of a MITM attack, which means the DNS hijack will do much less prolonged damage.
4. Avoid having low TTL where possible, specifically on master records.
DNS caching can delay a DNS hijacking. The higher the TTL (time to live), the longer a hijacked domain needs to stay hijacked before it can reach the masses. However, many services use low TTL; for instance, only one minute, for load-balancing purposes.
One way of avoiding low TTL on the master record in high-traffic services is to have the master record point to a number of static servers that serve a lean landing page and have all other services use a sub-domain with low TTL.
For example, you can have your-service.com with high TTL to serve a small landing/login page, and use www.your-service.com and api.your-service.com with low TTL service for the rest of the application. As long as the DNS records for your-service.com are set up with high TTL and point to your secure DNS servers, hijacking the registrar will take a fairly long time to hit the majority of users due to the caching nature of the DNS.
5. Use high TTL for MX records to delay the hijackers ability to reroute your emails.
Despite the fact email is known to be inherently insecure, a large amount of confidential information gets passed around in email inside companies. DNS hijackers can essentially steal these emails and cause considerable damage to an organization. Using high TTL for mail exchanger (MX) records in a DNS adds a delay for hijacking emails. Using email encryption such as PGP (pretty good privacy) will also ensure that attackers cant steal the information in the emails.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Thwart DNS Hijackers: 5 Tips