# MA-712.012019: MyCERT Advisory - Best Practices to Avoid DNS Hijacking

**Date:** 25 Jan 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-712.012019  
**Advisory ID:** MA-712.012019

---

**1.0 Introduction**
Recently, several incident on DNS hijacking occurred affecting domains that belong to government, telecommunications and internet infrastructure entities across the Middle East, Europe and North America and North Africa.
DNS Hijacking is a form of computer security hacking where involves changing DNS setting of a domain which redirect user traffic to attacker-controlled infrastructure. This attack allowing attacker(s) to access valid encryption certificates for executive branch agencies’ domain names and launch man-in-the-middle attacks.
Attackers may using the following technique then can redirected and intercepted web, mail traffic or other networked services;
1. Obtain account that can make changes to DNS records by compromising user credential.
2. Altering the DNS records such as Address (A), Mail Exchanger (MX) and Name Server (NS) records with an address the attacker controls.
3. Obtaining valid encryption certificates for an organization’s domain names which allow the redirected traffic to be decrypted.
**2.0 Impact**
This attack could enable attacker to redirect traffic to  attacker-controlled infrastructure and will lead to disclosure of confidential information to unauthorized person or organization.
**3.0 Affected Product/Systems**
Domain Names Server
**4.0 Recommendations**
Some of the preventive measures that users can take to avoid DNS hijacking are:
4.1 Audit DNS Records
For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers to verify they resolve to the correct Internet Protocol addresses or hostnames.
4.2  Changes DNS Account Passwords
Update the passwords for all accounts on the systems that can make changes to your agency’s DNS Record with a complex password.
Enforce password changing policy for certain period of time for all accounts on the systems that can make changes to your agency’s DNS Record.
4.3 Add Multi-Factor Authentication to DNS Accounts
Integrate multi-factor authentication (MFA) for all accounts on the systems that can make changes to your agency’s DNS records.
Agency are recommends using additional factor that are resilient to phishing. Consistent with NIST SP 800-63b, Short Message Service (SMS) based MFA is not recommended.
4.4 Monitor Certificate Transparency Logs
Agencies shall monitor CT log data for certificates issued that they did not request.
Search for encryption certificates 
Generally, MyCERT advises any 
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#02617b6067703b3b3b42617b60677071676177706b767b2c6f7b) or [[email protected]](/cdn-cgi/l/email-protection#c4a9bda7a1b6b084a9bda7a1b6b0eaabb6a3eaa9bd)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/alerts/AA19-024A>
- <https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html>
- <https://csrc.nist.gov/publications/detail/sp/800-63b/final>
- <https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html>