Abstract:Leveraging DNS for covert communications is appealing since most networks allow DNS traffic, especially the ones directed toward renowned DNS hosting services. Unfortunately, most DNS hosting services overlook domain ownership verification, enabling miscreants to host undelegated DNS records of a domain they do not own. Consequently, miscreants can conduct covert communication through such undelegated records for whitelisted domains on reputable hosting providers. In this paper, we shed light on the emerging threat posed by undelegated records and demonstrate their exploitation in the wild. To the best of our knowledge, this security risk has not been studied before. We conducted a comprehensive measurement to reveal the prevalence of the risk. In total, we observed 1,580,925 unique undelegated records that are potentially abused. We further observed that a considerable portion of these records are associated with malicious behaviors. By utilizing threat intelligence and malicious traffic collected by malware sandbox, we extracted malicious IP addresses from 25.41% of these records, spanning 1,369 Tranco top 2K domains and 248 DNS hosting providers, including Cloudflare and Amazon. Furthermore, we discovered that the majority of the identified malicious activities are Trojan-related. Moreover, we conducted case studies on two malware families (Dark.IOT and Specter) that exploit undelegated records to obtain C2 servers, in addition to the masquerading SPF records to conceal SMTP-based covert communication. Also, we provided mitigation options for different entities. As a result of our disclosure, several popular hosting providers have taken action to address this issue.

Subdomain Protection is Needed: an SPF and DMARC-Based Empirical Measurement Study and Proactive Solution of Email Security

Both Sides Needed: A Two-Dimensional Measurement Study of Email Security Based on SPF and DMARC

A Large-scale and Longitudinal Measurement Study of DKIM Deployment

Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks

BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet

A comprehensive examination of email spoofing: Issues and prospects for email security

Early Detection of Spam Domains with Passive DNS and SPF

Wolf in Sheep's Clothing: Evaluating Security Risks of the Undelegated Record on DNS Hosting Services

Detecting and Characterizing SMS Spearphishing Attacks.

Detecting and Measuring Security Risks of Hosting-Based Dangling Domains.

Survey on Domain Name System Security.

Revisiting Email Spoofing Attacks

Detecting and Measuring Security Implications of Entangled Domain Verification in CDN

Understanding the Implementation and Security Implications of Protective DNS Services

A Multi-Faceted Approach Towards Spam-Resistible Mail

Don't Let One Rotten Apple Spoil the Whole Barrel

An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come?

A Survey on Malicious Domains Detection through DNS Data Analysis

Quantifying Psychological Sophistication of Malicious Emails

Active Countermeasures for Email Fraud

RESEARCH AND DESIGN OF RELEASE-PERMISSION-BASED EMAIL AUTHENTICATION SYSTEM