ICANN Calls for DNSSEC for All Domains Following Domain Hijacking Attempts
This is nonsense, and possibly crossing the border from ignorant nonsense to malicious nonsense.<p>DNSSEC ensures that received DNS records are signed by an entity authorized to publish changes to the domain. It does not ensure, in any way, that this entity is publishing the right changes. It protects you against man-in-the-middle attacks, but not &quot;hijacking&quot; as usually envisioned. The linked article <a href="https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2019&#x2F;02&#x2F;a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks&#x2F;" rel="nofollow">https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2019&#x2F;02&#x2F;a-deep-dive-on-the-recen...</a> identifies multiple cases of registrars saying that someone broke into their web interface (either by determining valid account credentials, or finding a flaw in the web interface). DNSSEC is not designed to protect against these attacks. As that article points out, <i>some of the victims did in fact have DNSSEC set up</i>.<p>As &#x27;tptacek pointed out a few days ago, many .gov and .mil domains <i>have</i> DNSSEC and were nonetheless victims of DNS hijacking attacks. <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19180817" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19180817</a> The US government is correctly <i>not</i> insisting on additional rollout of DNSSEC.<p>I myself have been a victim of DNS hijacking: in January 2013, someone hijacked mit.edu and (among other things) redirected the MX records to non-MIT servers. <a href="https:&#x2F;&#x2F;thetech.com&#x2F;2013&#x2F;01&#x2F;23&#x2F;hack-v132-n63" rel="nofollow">https:&#x2F;&#x2F;thetech.com&#x2F;2013&#x2F;01&#x2F;23&#x2F;hack-v132-n63</a> I lost email to my mit.edu address as a result, and if the attacker were interested in targeting me (or targeting MIT account holders in general) they could have triggered password resets by email, etc. They got in because they apparently knew the password for MIT&#x27;s account at EDUCAUSE, domain registrar or guessed it on the first try. DNSSEC would not have prevented this. The attacker would have simply instructed EDUCAUSE to sign the records, or instructed EDUCAUSE to update the public key to one under the attacker&#x27;s control.<p>And, for bonus points, had they done so, they likely would have been able to lock out MIT of regaining control of the domain for longer than it actually took.