Christopher Krebs Explains Rationale Behind CISA’s Directive on DNS Tampering Campaign

Christopher Krebs, director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, has explained the reason behind CISA’s move to release its first emergency directive about Domain Name System tampering activities.

Reports from FireEye and Cisco Talos revealed that malicious actors gained access to accounts that regulated DNS records and “made them resolve to their own infrastructure before relaying it to the real address,” Krebs wrote in a blog post published Thursday.

“Because they could control an organization’s DNS, they could obtain legitimate digital certificates and decrypt the data they intercepted – all while everything looked normal to users.”

Krebs, a 2019 Wash100 winner, noted that CISA’s directive is an urgent response to the risk posed by an active attacker that homes in on government organizations and compromises legitimate traffic to obtain data, cause delay or disrupt services.

“We know that this type of attack isn’t something many organizations monitor for or have tight controls around,” he said of the DNS hijacking campaign.
 

You may also be interested in...

Katie Olson

Katie Olson to Temporarily Succeed Brett Goldstein as Defense Digital Service Director

Katie Olson, deputy director of the Defense Digital Service (DDS), will serve as the agency's acting leader as Brett Goldstein steps down. Goldstein led DDS as director for a couple of years. Olson, Goldstein's temporary successor, joined DDS in 2019 as chief of staff then became the agency's deputy director in 2020.