DNS Typos Expose US Government Agencies to Impersonation and Spying

Simple oversights in domain name system (DNS) records are exposing government organizations to potential impersonation, spying, and other malicious activities. A recent study conducted by Alex Shakhov, founder of SH Consulting, analyzed over 25,000 government-related domains and identified dozens with DNS records that referenced mistyped, expired, or otherwise repurposed domains. These vulnerabilities, though affecting a relatively small number of agencies, put towns, cities, counties, and regulatory boards at significant risk.

Many of the erroneous records pointed to domains that were either available for attackers to register or had already been claimed. Depending on the specific error, this could allow malicious actors to send or receive email on behalf of the affected government agencies, reconfigure their DNS records, or access sensitive security information. Shakhov emphasized the danger of these typos, stating that they effectively constitute a hack without any systems being breached, as attackers can leverage the established reputation of a legitimate government domain to send fraudulent emails and exploit user trust.

The study highlighted specific examples, including Livingston County, Michigan, and the city of Pikeville, Kentucky. Both entities appeared to have authorized Amazon's Simple Email Service (SES) for their email needs, but their TXT records contained typos: "amzonses[.]com" and "amasonses[.]com," respectively. This allowed non-Amazon entities to send emails on their behalf. An analysis of Pikeville's Sender Policy Framework (SPF) records revealed 75 authorized IP addresses, while Livingston County's listed over 32,000, suggesting a potential "snowshoe" operation where attackers rotate sending IPs to evade detection.

In the case of Livingston County, the SPF list had been rotated every three to eight days since 2021, indicating a sustained effort by an attacker to send unwanted or malicious emails. While this doesn't definitively prove abuse, it demonstrates the capability for it. Shakhov connected the actor behind this compromise to a group previously seen abusing domains from major corporations and universities, as well as the Connecticut state government, due to expired CNAME records.

Beyond SPF records, other DNS record types are also susceptible to abuse. If an attacker registers a "dangling" domain, they could intercept mail via MX records, serve spam through CNAME or NS records, conduct phishing attacks that appear to originate from legitimate senders via SPF, or gather intelligence through DMARC reports. For instance, the City of Rupert, Idaho's website referenced an old domain name for its neighbor, Heyburn, which was purchased by a malicious actor who then reconfigured its name server records to point to a gambling website and gained the ability to send emails from the @heyburnidaho.org suffix.

Furthermore, attackers could gain access to sensitive information by obtaining control of DMARC reporting domains. DMARC, an email authentication protocol, sends reports that can contain details about an organization's email infrastructure. Shakhov identified 11 local government institutions, including four county and law enforcement agencies in Indiana, at risk of this type of information theft.

Shakhov noted that exploiting these DNS vulnerabilities is a low-effort, low-cost strategy for attackers. They constantly scan DNS records for errors and mistyped domains, as it's one of the easiest ways to gain access to an organization's infrastructure. The public nature of DNS records, combined with the relatively small number of government domains to scan, makes this an attractive target for automated attacks that can be performed multiple times a day with minimal expense.