1. DNS/hijacking/事例

Contents

DNS/hijacking/事例

最近起きたのはDynamic Updateの欠陥（実装）を突いて、書き換えるとか。

https://doc.powerdns.com/md/authoritative/dnsupdate/

DNS/Changer

事例集：　黒塗りのDNS http://www.e-ontap.com/dns/ssmjp/#(1)

1.1. Through Abandoned CNAME

https://twitter.com/Michel_Gaschet/status/979265806575038465

On past year, I was able to hijack 29 subdomains of msn.[ccTLD] website. Reported to MSRC, ofc.

Only one have been fixed and taken offline, And guess wat? Now i'm able to takeover 27 new subdomain of microsoft.[ccTLD] and live.[ccTLD] domain . Simply Through Abandoned CNAME. 16:55 - 2018年3月29日

1.2. 歴史

1.3. 2019

Eaplayinvite.ea.com Subdomain Hijacking https://research.checkpoint.com/ea-games-vulnerability/

eaplayinvite.ea.com CNAME ea-invite-reg.azurewebsites.net

Microsoft loses control of the crucial Windows Tiles subdomain by Anmol

@anmol_112

Apr 18, 2019 at 16:00 GMT https://mspoweruser.com/microsoft-loses-control-of-the-crucial-windows-tiles-subdomain/

Global DNS Hijacking Campaign: DNS Record Manipulation at Scale January 09, 2019 | by Muks Hirani, Sarah Jones, Ben Read

https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html

参考訳： https://www.fireeye.jp/blog/jp-threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html

Posted on April 4, 2019 by Troy Mursch Ongoing DNS hijacking campaign targeting consumer routers

https://badpackets.net/ongoing-dns-hijacking-campaign-targeting-consumer-routers/

/SeaTurtle Wednesday, April 17, 2019 DNS Hijacking Abuses Trust In Core Internet Service (sea turtle) https://blog.talosintelligence.com/2019/04/seaturtle.html

Middle East and North Africa

Widespread DNS Hijacking Activity Targets Multiple Sectors

January 25, 2019 Matt Dahl

https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/

South Africa’s .ZA domain is a security disaster waiting to happen https://www.digitalmunition.me/2019/04/south-africas-za-domain-is-a-security-disaster-waiting-to-happen

lovelive-anime.jpが../移管された事件：　完全に取られた!

2019-04-08 不正移管によるドメイン名ハイジャックについてまとめてみた https://piyolog.hatenadiary.jp/entry/2019/04/08/053000

DoHSからの警告 https://cyber.dhs.gov/assets/report/ed-19-01.pdf

https://nakedsecurity.sophos.com/2019/01/25/us-gov-declares-emergency-after-wave-of-domain-hijacking-attacks/

lovelive-anime.jp 事件　　2019-04-05 接続出来ない。 watchA/star-domain/lovelive-anime.jp

/yamanashi-med.ac.jp

/starbucks /periscope.tv

1.4. 2018

DNS/運用/Zoho

CRM業者のZoho.comのゾーン情報がサービス業者(レジストラ)によって書き換えられた。(支払い忘れ?によるsuspend)
- 2018年9月25日(日本時間)

DNS/運用/amusecraft事件　移管手続き

2018年9月27日　乗取った人物がtweetしていた。

DNSハイジャックで仮想通貨を窃取--古典的攻撃手法に警鐘 ZDNet Japan Staff 2018年04月25日 15時12分 https://japan.zdnet.com/article/35118344/

The myetherwallet.com hijack and why it’s risky to hold cryptocurrency in a webapp Sharon Goldberg Apr 26, 2018 https://medium.com/@goldbe/the-myetherwallet-com-hijack-and-why-its-risky-to-hold-cryptocurrency-in-a-webapp-261131fad278

いくつかのDNSサーバーがハイジャックされました。 http://myetherwallet.com ユーザーがフィッシングサイトにリダイレクトされる可能性があります。これは@ myetherwallet側ではなく、解決するサーバをできるだけ早く確認する作業中です。 https://twitter.com/conemaru_btc/status/988795263698460672

Hackers Hijack DNS Server of BlackWallet to Steal $400,000 https://www.bleepingcomputer.com/news/security/hackers-hijack-dns-server-of-blackwallet-to-steal-400-000/

December 13th 2018 CenturyLink is blocking its customers' internet while saying Utah legislators told them to https://www.richsnapp.com/blog/2018/12-13-centurylink-blocking-internet-in-utah

1.5. 2017

Ethereum https://ethereum-japan.net/ethereum/the-world-computer-and-future/

EtherDeltaがハックされ約2650万円が盗まれる https://ethereum-japan.net/ethereum/the-world-computer-and-future/#1EtherDelta2650

/akatsuki-novels.com

Another day, another mass domain hijacking Gandi admits logins stolen, 750 web addresses pointed to malware By Kieren McCarthy in San Francisco 13 Jul 2017 at 21:52 https://www.theregister.co.uk/2017/07/13/swiss_domain_name_hijack/

1.6. 2016

The Morphus Labs warns about another major threat, the domain hijacking incident, a threat that can completely subvert your information security strategy. http://securityaffairs.co/wordpress/52716/hacking/domain-hijacking.html