New Class of DNS Vulns Affecting DNS-as-a-Service Platforms
Wiz researchers disclose a novel architectural vulnerability in DNS-as-a-Service platforms like AWS Route 53, enabling cross-tenant dynamic DNS eavesdropping and data theft.
Summary
The Hidden Shared Infrastructure of Cloud DNSaaS
Major cloud providers operate multi-tenant DNS-as-a-Service (DNSaaS) platforms, resolving billions of internal and external DNS queries across distinct customer environments.
Discovering Cross-Tenant Dynamic DNS Hijacking
Shir Tamari and Ami Luttwak demonstrate how an unprivileged cloud tenant can register arbitrary domain names within shared DNSaaS name servers.
Intercepting Internal Corporate Traffic at Scale
Exploiting name server collision allowed the researchers to hijack dynamic DNS updates, exfiltrating internal computer names, IP mappings, and Active Directory authentication tokens from Fortune 500 enterprises.
Cloud Provider Remediation and Resolver Isolation
The authors detail their coordinated disclosure across major cloud providers (including AWS Route 53) and present architectural mitigations to prevent multi-tenant DNS pollution.
Related talks
Security Fest·35 min
Frans Rosén
2017 details DNS hijacking using cloud providers - Frans Rosén.
OWASP Foundation·36 min
Analysts investigate attack surfaces and defenses concerning AppSec EU 2017 DNS Hijacking Using Cloud Providers: No Verification Needed by Frans Rosén.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.