(Aug 4, 2021)

We have no way of knowing whether the loophole has already been exploited: Anyone could have collected data undetected for over a decade.

We do know this is still an active threat vector – while two major DNS providers (Amazon and Google) have fixed the issue, others may still be vulnerable. As a result, millions of devices are potentially vulnerable.

(…)

After analyzing it, we learned it was dynamic DNS traffic from Windows machines that were querying the hijacked name server about itself. Dynamic DNS keeps DNS records automatically up to date when an IP address changes. It’s traditionally been used in large networks that host internal services, and use their own internal servers. In short, the traffic we received contained sensitive information that was never supposed to leave an organizations internal network.

The dynamic DNS traffic we “wiretapped” came from over 15,000 organizations, including Fortune 500 companies, 45 U.S. government agencies, and 85 international government agencies. The data included a wealth of valuable intel like internal and external IP addresses, computer names, employee names and office locations.