Air-Gapped Networks Vulnerable to DNS Attacks

[upnorth]

Content source

https://www.darkreading.com/attacks-breaches/report-air-gapped-networks-vulnerable-dns-attacks

Common misconfigurations in how Domain Name System (DNS) is implemented in an enterprise environment can put air-gapped networks and the high-value assets they are aimed at protecting at risk from external attackers, researchers have found.

Organizations using air-gapped networks that connect to DNS servers can inadvertently expose the assets to threat actors, resulting in high-impact data breaches, researchers from security firm Pentera revealed in a blog post published Dec. 8. Attackers can use DNS as a command-and-control (C2) channel to communicate with these networks through DNS servers connected to the Internet, and thus breach them even when an organization believes the network is successfully isolated, the researchers revealed.

Air-gapped networks are segregated without access to the Internet from the common user network in a business or enterprise IT environment. They are designed this way to protect an organization's "crown jewels," the researchers wrote, using VPN, SSL VPN, or the users' network via a jump box for someone to gain access to them. However, these networks still require DNS services, , which is used to assign names to systems for network discoverability. This represents a vulnerability if DNS is not configured carefully by network administrators.

With DNS attacks occurring more frequently than ever - with 88% of organizations reporting some type of DNS attack in 2022, according to the latest IDC Global DNS Threat Report - it's important for organizations to understand how to mitigate and defend against DNS abuse, the researchers said.

Report: Air-Gapped Networks Vulnerable to DNS Attacks

Common mistakes in network configuration can jeopardize the security of highly protected assets and allow attackers to steal critical data from the enterprise.

www.darkreading.com

 

[TedCruz]

Report: Air-Gapped Networks Vulnerable to DNS Attacks

Common mistakes in network configuration can jeopardize the security of highly protected assets and allow attackers to steal critical data from the enterprise.

www.darkreading.com

Yeap that's why SIPR and JWICS have their own dedicated fibre that does not ride on common network backbone. The only negative thing about it is how slow they are (most of it is due to very heavy encryption).