The Internet Corporation for Assigned Names and Numbers (ICANN) declared an emergency meeting that discussed "an ongoing and significant risk" to key parts of the internet infrastructure.
According to the internet’s address keeper, there are parts of the internet infrastructure that face large-scale attacks that threaten the global system of web traffic.
This malicious activities don't target websites in general, but aim to sneak inside the Domain Name System or DNS which routes traffic to intended online destinations.
Specifically, the hackers phished credentials that PCH’s registrar use to send signaling messages known as the Extensible Provisioning Protocol (EPP).
This EPP is what serves as a kind of backend for the global DNS system, allowing domain registrars to notify regional registries about changes to domain records, including new domain registrations, modifications, and transfers.
The people at ICANN said that the attacks have a potential to steal data along the way, as well as sending web traffic elsewhere, or enable the attackers to impersonate or "spoof" critical websites.
“They are going after the internet infrastructure itself,” said ICANN chief technology officer David Conrad. "There have been targeted attacks in the past, but nothing like this."
“There isn’t a single tool to address this,” Conrad continued, as ICANN called for an increase in internet security.
U.S. authorities had issued a similar warning in the past about the DNS attacks.
"This is roughly equivalent to someone lying to the post office about your address, checking your mail, and then hand delivering it to your mailbox," explained the U.S. Department of Homeland Security in a cybersecurity alert.
"Lots of harmful things could be done to you (or the senders) depending on the content of that mail."
ICANN held an emergency meeting, and is urging websites and online traffic handlers to ramp up their security efforts. Otherwise, users would be vulnerable to being tricked into trusting the wrong online destinations.
It was predicted that such attacks happened since at least 2017, said a FireEye senior manager of cyberespionage analysis Ben Read. And as for the targets the list included website registrars and internet service providers, particularly in the Middle East.
“We’ve seen primarily targeting of email names and passwords,” the specialist said, explaining the attacks being dubbed “DNSpionage.”
"There is evidence that it is coming out of Iran and being done in support of Iran."
Similar attacks took place in Europe and other parts of the Middle East, with targets including governments, intelligence services, police, airlines, and the oil industry, cybersecurity specialists said. "You definitely need knowledge of how the internet works and have to handle a lot of traffic being directed to you."
"With that access, they could temporarily break portions of how the internet works. They chose to intercept and spy on folks."
