ICANN Calls For DNSSEC Deployment For All Unsecured Domains Following Domain Hijacking Attempts

As one of many entities engaged in the decentralised
management of the Internet, ICANN is specifically responsible for coordinating
the top-most level of the DNS to ensure its stable and secure operation and
universal resolvability.

On 15 February 2019, in response to reports of attacks
against key parts of the DNS infrastructure, ICANN offered a checklist of
recommended security precautions for members of the domain name industry,
registries, registrars, resellers, and related others, to proactively take to
protect their systems, their customers’ systems and information reachable via
the DNS.

Apart from ICANN, organisations warning of the domain name hijacking attempts included Verisign and the ccTLD registry for the Netherlands, SIDN.

Public reports indicate that there is a pattern of
multifaceted attacks utilising different methodologies. Some of the attacks
target the DNS, in which unauthorised changes to the delegation structure of
domain names are made, replacing the addresses of intended servers with
addresses of machines controlled by the attackers. This particular type of
attack, which targets the DNS, only works when DNSSEC is not in use. DNSSEC is
a technology developed to protect against such changes by digitally ‘signing’
data to assure its validity. Although DNSSEC cannot solve all forms of attack
against the DNS, when it is used, unauthorised modification to DNS information
can be detected, and users are blocked from being misdirected.

ICANN has long recognised the importance of DNSSEC and is
calling for full deployment of the technology across all domains. Although this
will not solve the security problems of the Internet, it aims to assure that
Internet users reach their desired online destination by helping to prevent
so-called “man in the middle” attacks where a user is unknowingly re-directed
to a potentially malicious site. DNSSEC complements other technologies, such as
Transport Layer Security (most typically used in HTTPS) that protect the end
user/domain communication.

As the coordinator of the top-most level of the DNS, ICANN is in the position to help mitigate and detect DNS-related risks, and to facilitate key discussions together with its partners. The organisation believes that all members of the domain name system ecosystem must work together to produce better tools and policies to secure the DNS and other critical operations of the Internet. To facilitate these efforts, ICANN is planning an event for the Internet community to address DNS protection: The first is an open session during the upcoming ICANN64 public meeting on 9-14 March 2019, in Kobe, Japan.

In their 15 February announcement, ICANN noted they “trust that [the] DNS industry actors are already taking strong security precautions in your business.” To help they compiled the following checklist to consider:

• Ensure all system security patches have been reviewed and have been applied;
• Review log files for unauthorized access to systems, especially administrator access;
• Review internal controls over administrator (“root”) access;
• Verify integrity of every DNS record, and the change history of those records;
• Enforce sufficient password complexity, especially length of password;
• Ensure that passwords are not shared with other users;  
• Ensure that passwords are never stored or transmitted in clear text;
• Enforce regular and periodic password changes;
• Enforce a password lockout policy;
• Ensure that DNS zone records are DNSSEC signed and your DNS resolvers are performing DNSSEC validation;
• Ideally ensure multi-factor authentication is enabled to all systems, especially for administrator access; and
• Ideally ensure your email domain has a DMARC policy with SPF
  and/or DKIM and that you enforce such policies provided by other domains
  on your email system.