2018: The Year That Saw DNS Hacks Bring the Internet to its Knees

2018 has turned out to be the year of the breach. No sooner than we got over November’s LastPass outage, the first week alone in December revealed Marriott and Quora had been hacked, exposing 600 million internet users.Worryingly, the huge organizations who were victims of these attacks and exposed their customers’ passport, CVV and credit cards details may actually be hiding even more than they have revealed so far. Some have compromised not just their customers’ details, but their DNS: the first line of defense for their network security.

The 2018 Global DNS Threat Report revealed 77% organizations were subject to DNS attacks in the previous 12 months. As 2018 draws to a close, let’s have a look at some of the biggest hacks that hit and, almost, broke the internet.

Apple was shamed by a 16 year old, who ‘tunneled’ his way into its servers and gained access to 90 gigabytes of files over a 12 month period, all while he sat in his Melbourne home. The fact he aspired to work at Apple and kept all that data in a folder called ‘hacky hacky hack’ failed to make Apple look prepared and secure. This incident showed how easy it is for hackers to bypass firewalls undetected.

The 2018 Global Threat Report revealed, 20% of organizations around the world were victims of DNS tunneling in the past year. Extremely difficult to detect, DNS tunneling is attractive to hackers as businesses often only get to know about the exfiltration long after it has been achieved.

The banking sector also suffered globally. Some of the affected banks included TSB and RBS, who all had meltdowns throughout the year. Some were forced to reduce operations and shut down entire systems due to these hacks. Embarrassingly, the Bank of England had to intervene and set an Operational Resilience deadline for UK’s financial sector.

Traces of the financial sector’s trouble were also visible in the 2018 Global Threat Report, which highlighted DNS attacks on financial organizations cost on average $924,390 . This cost was up from $588,200 last year, an annual increase of 57%. This figure exclude the inevitable brand image and customer loyalty.

Reports of a new evolved malware, ‘Xbash’, also circulated. Its self-spreading capabilities combined crypto mining and ransomware functions. It targets systems protected by a weak password and machines that run with unpatched, known vulnerabilities. This brought patching back to the top of the priority list of IT teams. Interestingly, the DNS Threat Report also revealed 71% of companies took three days or more to install a security patch on their systems, leaving them vulnerable to attacks. This compares with 74% of utilities firms and 63% of public sector institutions.

The aviation sector was also caught unaware, large airlines like Air Canada and Cathay Pacific suffering data and security breaches. These hacks resulted in tremendous loss of sensitive information as passport details, security numbers and credit details of millions of customers were compromised. Classic cases of data exfiltration which were carried out over a period of time, bringing to light the importance of consistent and diligent assessment of network traffic. It reiterates the necessity for brands to have context-aware analysis of DNS traffic to detect data exfiltration attempts, assessing external threats and strange DNS traffic which could slyly enter the server.

EfficientIP Recommendations

With forms of attacks evolving, EfficientIP recommends brands follow best security practices to mitigate attacks and avoid the damage that follows. To augment the security of your network:

• Know where the threats to users lie – Upgrade threat intelligence on domain reputation with data feeds that provide insight on menaces through global traffic analysis. Users should be safeguarded against internal/external attacks through the blocking of malware and mitigation of data exfiltration attempts.
• Look for unusual behavior in the traffic – Expand threat visibility with live and context-aware DNS transaction analytics for behavioral threat detection. All threat types can be detected and stopped to comply with the EU’s GDPR and the US CLOUD Act.
• Protect your brand with the agility of a hacker – Apply adaptive countermeasures pertinent to threats. Business continuity can be assured even when attack sources are unidentifiable, reducing the risk of blocking genuine users.
• Don’t assume your brand is protected by cloud providers – Purpose-built DNS security solutions harden security for cloud/next-gen data centers, overcoming limitations of solutions from cloud providers. Continued access to cloud services and apps is assured, as is protecting against cloud-stored data exfiltration.
• Your users care about overall security, not the layers – Blend DNS into the overall network security solution to notify the broader security ecosystem. Holistic network security can address growing network risks while protecting against moving threats.

Businesses reported DNS attacks have doubled over the last 12 months from last year’s report to this year’s. In the years to come, ensuring service continuity and data confidentiality will become evermore important. We hope the next report shows attacks are better defended against, lowering the cost of damage for each attack…however, this remains to be seen.

2018 has demonstrated once again that as DNS is a network foundation, any hacks targeting DNS can cripple the very core of a network. This past year has shown that organizations in all sectors would do well to enhance their DNS security and protect their networks with dedicated, contextual solutions. Here’s to a safe and prosperous New Year!

Make a New Year’s resolution to secure your DNS infrastructure – learn more in our DNS Security Best Practices white paper.