Since WannaCry and NotPetya struck the internet just over three years ago, the security industry has scrutinized every new Windows bug that could be used to create a similar world-shaking worm. Now one potentially “wormable” vulnerability—meaning an attack can spread from one machine to another with no human interaction—has appeared in Microsoft’s implementation of the domain name system protocol, one of the fundamental building blocks of the internet.
As part of its Patch Tuesday batch of software updates, Microsoft today released a fix for a bug discovered by Israeli security firm Check Point, which the company’s researchers have named SigRed. The SigRed bug exploits Windows DNS, one of the most popular kinds of DNS software that translates domain names into IP addresses. Windows DNS runs on the DNS servers of practically every small and medium-sized organization around the world. The bug, Check Point says, has existed in that software for a remarkable 17 years.
Check Point and Microsoft warn that the flaw is critical, a 10 out of 10 on the common vulnerability scoring system, an industry-standard severity rating. Not only is the bug wormable, Windows DNS software often runs on the powerful servers known as domain controllers that set the rules for networks. Many of those machines are particularly sensitive; a foothold in one would allow further penetration into other devices inside an organization.
On top of all of that, says Check Point’s head of vulnerability research Omri Herscovici, the Windows DNS bug can in some cases be exploited with no action on the part of the target user, creating a seamless and powerful attack. “It requires no interaction. And not only that, once you’re inside the domain controller that runs the Windows DNS server, expanding your control to the rest of the network is really easy,” says Omri Herscovici. “It’s basically game over.”
The Hack
Check Point found the SigRed vulnerability in the part of Windows DNS that handles a certain piece of data that’s part of the key exchange used in the more secure version of DNS known as DNSSEC. That one piece of data can be maliciously crafted such that Windows DNS allows a hacker to overwrite chunks of memory they’re not meant to have access to, ultimately gaining full remote code execution on the target server. (Check Point says Microsoft asked the company not to publicize too many details of other elements of the technique, including how it bypasses certain security features on Windows servers.)
For the remote, no-interaction version of the attack that Check Point’s Herscovici describes, the target DNS server would have to be exposed directly to the internet, which is rare in most networks; administrators generally run Windows DNS on servers that they keep behind a firewall. But Herscovici points out that if a hacker can get access to the local network by accessing the corporate Wi-Fi or plugging a computer into the corporate LAN, they can trigger the same DNS server takeover. And it may also be possible to exploit the vulnerability with just a link in a phishing email: Trick a target into clicking that link and their browser will initiate the same key exchange on the DNS server that gives the hacker full control of it.
Check Point only demonstrated that it could crash a target DNS server with that phishing trick, not hijack it. But Jake Williams, a former National Security Agency hacker and founder of Rendition Infosec, says it’s likely that the phishing trick could be finessed to allow a full takeover of the target DNS server in the vast majority of networks that don’t block outbound traffic on their firewalls. “With some careful crafting, you could probably target DNS servers that are behind a firewall,” Williams says.
Who’s Affected?
While many large organizations use the BIND implementation of DNS that runs on Linux servers, smaller organizations commonly run Windows DNS, says Williams, so thousands of IT administrators will likely need to rush to patch the SigRed bug. And because the SigRed vulnerability has existed in Windows DNS since 2003, practically every version of the software has been vulnerable.
