Cyber Defense eMagazine February Edition for 2023

Exchange (MX) and Name Service (NS) records and replace a legitimate address with their own to
redirect all traffic.
People naturally trust internal emails from their boss or colleagues. We rarely subscribe to the term used
to call cyber criminals as “sophisticated,” however, one thing for sure is they know if they can
commandeer an MX Server and take control of it, so their phishing emails now become internal emails
coming from the same server and masquerading as bona fide emails, their chances of success are greatly
increased as opposed to external, highly suspicious emails that can be caught by spam or virus tools.
DNS plays a pivotal role in overall security. Security professionals understandably are a tad divided on
the criticality of DNS due to lack of knowledge. If they have not studied, or do not fully comprehend DNS,
it is often pushed back as not relevant. This is a grave error.
This is more than a tremendous shame; it is a nothing short of a tragedy. Given the papers by
Governments, Agencies, Emergency Directives following Federal Agency on DNS attacks, this stance is
an incredibly dangerous position to adopt and maintain. The reluctance by some security professionals
sadly can and does create false positives. When a company believe they are secure and receive evidence
of their DNS is exposed and can be tampered with, their dismissal can overlook and ignore major exposed
vulnerabilities. Such instances can lead to a ‘Doctor administering a medicinal remedy only to
unknowingly administer access to the very poison killing the patient.’
A cyberattack causes chaos, disruption, damages the brand and can have a negative impact and
reduction on the share price. SolarWinds shares are trading at less than $10 from a high of $24 prior to
their cyberattack in 2020. It is not uncommon to witness cyber security budgets greatly increased
following a cyber incident and hear that “sophisticated attackers’ had gained access. What is never said
is that due to oversights, errors, sometimes even negligence, access was easily achieved into the network
that caused the cyber incident. Sadly, one can never rule out internal foul play.
If we consider last week’s Federal Aviation Authority (FAA) ‘outage,’ an initial statement was made that
a corrupt file caused the incident. Ms. Katie Arrington, the former CISO for the Department of Defence,
said in a publicly shared LinkedIn video: ‘’Anyone who thinks this was a corrupt file issue knows nothing
about cyber security.’’ Katie has been very vocal on her insight and knowledge of this ‘outage.’
Our research showed that within hours following the ‘outage’ that grounded the entire United States from
all flights on the 11 th of January, the Website https://notams.aim.faa.gov had replaced a critical Digital
Certificate. This could of course be a coincidence. It could also be a strategic action in case the incident
was more than just an outage. However, not all digital certificates were replaced.
The main concern is that the FAA’s DNS was and remains suboptimal and exposed to tampering as the
U.S. Government issued the 19-01 DNS Mitigation program in 2019. Due to this error, the newly issued
digital certificate is not ensuring authentication, nor encryption. This oversight ensures the FAA, the FAA’s
partners, and the FAA’s clients, the American public are equally as exposed to cyber incidents today as
it was the day prior to the incident.
An internationally recognized DNS Expert, the late Mr. Dan Kaminsky showed Microsoft DNS issues back
in a secret meeting in Microsoft’s Redmond headquarters in 2008 when he, along with Dr Paul Vixie,
Cyber Defense eMagazine – February 2023 Edition 109
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.