Domain Name Hijacking

Domain Name Hijacking or Domain Hijacking refers to the security breach that occurs when an outside agent, such as a hacker, gains control over a domain registered to another individual or organization. Hijacking can be accomplished via various practices and often results in domain name registrants losing control of their domains as traffic is redirected to a different site, the content of the original site is changed, or the outside agent switches the control of the name through the registrar. This practice has reportedly tripled since 2005 and is related to Reverse Domain Name Hijacking

Types of Redirection

Also called DNS Hijacking, this practice refers to situations in which queries are incorrectly resolved in order to redirect users to malicious sites due after perpetrators have installed Malware on user computers, taken over routers, or intercepted DNS communication.

• Local - when Trojan malware is installed on a user’s computer, it changes the local DNS settings to redirect the user to malicious destinations.
• Router - when attackers take over routers, they can overwrite DNS settings.
• Man in the middle - attackers intercept communication between a user and a server and change the destination IP address.
• Rogue server - when a server is hacked and the DNS records are changed to redirect DNS requests to malicious sites.

Public Perception

Domain name hijacking is viewed negatively by most people and can be referred to as domain theft.

Outcome

The broader outcome of this behavior is that users' domain names are at risk from predatory parties. Individuals can lose control of their domain names and larger organizations can face major losses, monetarily and in consumer confidence.

Vectors

Domain name hijacking has been used for a number of purposes, such as "malice and monetary gain." If the hijacked site deals with Internet commerce or retail, for example, its users may be redirected to a phishing webpage designed to steal their financial information. A domain name is vulnerable to hijacking through a number of different avenues:

• DNS Servers: if the DNS is hijacked or poisoned, people typing in a domain name may be redirected to another page without their knowledge. This method does not require any registrant account information to be compromised or readily available. See DNS Hijacking for more information.

• Registrar Security: if a registrar's security is compromised and a domain name is not locked, it could be transferred to a different user and registrar before the owner is notified.

• Email Security: a third party can use WHOIS to find information about a registrant, such as a personal email account, and once the email account is compromised, use it to request a new password from the registrar. If the third party gains access to the registrant's account with its registrar, it can change primary ownership and notification information.

• Phishing: an outside agent can pose as a representative of the registrar and ask for log-in information directly.

Notorious Cases

• Sea Turtle Attacks
  

On April 17, 2019, Cisco's Talos security division identified a hacker group called "Sea Turtle" conducting espionage via DNS hijacking among at least 40 organizations. Se Turtle was able to compromise country-code top-level domains. The victims included telecoms, internet service providers, registrars, ministries of foreign affairs, intelligence agencies, military targets, and energy-related groups, all based in the Middle East and North Africa. The hackers silently carried out Man in the Middle Attacks to intercept all internet data being sent to the victim organizations.

ICANN Responses

• DNS Security Facilitation - Technical Study Group

ICANN Policy

• Inter-Registrar Transfer Policy: This policy requires that registrars send registrants an authorization/confirmation notice when domain names are going to be transferred and that registrants reply in a secure way.

• Registrar Transfer Dispute Resolution Policy: This policy outlines how registrars deal with transfer disputes, including unauthorized transfers.
  • Note: It can be challenging to prove to registrars that a domain name has been hijacked as "Registrars are often skeptical of claims of domain hijacking."

Legislation

There is no U.S. legislation that directly addresses domain name hijacking. However, as it potentially can involve theft, fraud, identity theft, and phishing, there are avenues for legal redress. It is worth noting that proving domain name ownership after being hijacked can be difficult.

Additional Resources and Tips

• Read ICANN's Report on Domain Name Hijacking for a brief overview of domain name hijacking and a thorough account of notable domain hijacking incidents
• View How to Recover a Hijacked Domain
• View ICANN's Standardized Authorization Form required to transfer domain names from one registrar to another
• For tips on how to prevent domain name hijacking, read Help! My Domain Name Has Been Hijacked!

Related Articles

• Reverse Domain Name Hijacking

Security and Stability Advisory Committee. Advises the ICANN community and Board on matters relating to the security and integrity of the Internet's naming and address allocation systems (ICANN Bylaws).