Authors: Jacques Portal, Renée Burton Hazy Hawk is a DNS-savvy threat actor that hijacks abandoned cloud resources of high-profile organizations. By âcloud resourcesâ we mean things like S3 buckets and Azure endpoints. You might have read about domain hijacking; we and other security vendors have written about different techniques for grabbing control of forgotten domain names several times over t
Researchers at Infoblox and Eclypsium have discovered that a powerful attack vector in the domain name system (DNS) is being widely exploited across many DNS providers. We have found that over a dozen Russian-nexus cybercriminal actors are using this attack vector to hijack domain names without being noticed. We call this the Sitting Ducks attack. There are over a million exploitable target domain
When you type something like âgoogle.comâ into your browser and hit enter, your device must query a known recursive resolver to find google.comâs IP address. Recursive resolvers are provided by most ISPs, but resolvers like 1.1.1.1 or 8.8.8.8 exist as well. You can query a resolver manually using something like dig or dog: ⯠dig @1.1.1.1 news.ycombinator.com ; <<>> DiG 9.18.4-2-Debian <<>> @1.1.1.
ã¯ããã« SoftwareDesign 8æå·ã®DNSç¹éã«ã¦è¨äºãæ¸ããã¦ããã ãã¾ãããã¿ããªè²·ã£ã¦ãã ã§ãå®ã¯æåã«æ¸ãã¦ãå稿ã¯ãã£ã¨é·ãã£ããã§ããã©ãç´å¹ ã®é½åã§ä¸é¨ã®å 容ã«ã¤ãã¦ã¯æ²è¼ãè¦éãã¾ããããã£ããæ¸ããã®ã«æ¨ã¦ãã®ã¯ãã£ãããªãã®ã§ãå æ¥ãããªãããDNS Summer Day 2022ã§çºè¡¨ããããã¨æºåãã¦ããã§ãããéä¸ã§æ°ãå¤ãã£ã¦éãå 容ã«ãªãã¾ããããããªããã§ãæçµçã«ã¨ã³ã¸ãã¢ããã°ã«ã¦ä¾é¤ãã¾ããå çä¿®æ£ãã¾ãã£ã¦ããã®ã§å ã®åç¨¿ã®æ°é ã¯ãã¯ãæ®ãé¦ç¨åº¦ã«æ¼ãã ãã§ããã ACMEã§dns-01ãã£ã¬ã³ã¸ ãµã¼ãè¨¼ææ¸ãç¡æãã¤èªåã§åå¾ã§ãããµã¼ãã¹ã¨ãã¦æåãªãã®ã«Letâs Encryptãããã¾ãããLetâs Encryptã®ä»çµã¿ã¯Letâs Encryptç¬èªã®ãã®ã§ã¯ããã¾ãããACME (RFC8555)ã¨ãã¦æ¨æºåããã¦ãã¦
ã¿ãªããã¯ãããµããã¡ã¤ã³ ãã¤ã¯ãªã¼ãã¼ãã¨ããã»ãã¥ãªãã£ã®åé¡ããåãã§ãã? ãµããã¡ã¤ã³ ãã¤ã¯ãªã¼ãã¼ã¯ã以åããåå¨ããä¸è¬çãªã»ãã¥ãªãã£ã®åé¡ã§ãããã¯ã©ã¦ã ãµã¼ãã¹ã®å©ç¨å¢å ã«ä¼´ããç¹ã«æ³¨æãå¿ è¦ã«ãªã£ã¦ãã¾ãããã¤ã¯ãã½ããã®ãµã¼ãã¹ã ãã«çºçããåé¡ã§ã¯ããã¾ããããMicrosoft Azure ãä¾ã«æããªããããµããã¡ã¤ã³ ãã¤ã¯ãªã¼ãã¼ã®æ¦è¦ãçºçåå ã¨å¯¾çã«ã¤ãã¦è§£èª¬ãããã¨æãã¾ãã [1] ãµããã¡ã¤ã³ ãã¤ã¯ãªã¼ãã¼ã¨ã¯ï¼ ãµããã¡ã¤ã³ ãã¤ã¯ãªã¼ãã¼ (Subdomain Takeover) ã¯ãDNS ã¬ã³ã¼ãã®ä¸é©åãªç®¡çãè¦å ã¨ãªã£ã¦çºçããã»ãã¥ãªãã£ã®åé¡ã§ããä¾ãã° CDN (Content Delivery Network) ãµã¼ãã¹ãªã©ã®å¤é¨ã®ãµã¼ãã¹ãå©ç¨ããéãèªçµç¹ã管çãããã¡ã¤ã³ããµããã¡ã¤ã³ãå¤é¨ã®ãµã¼ãã¹ã«åå解決ã
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}