Highlights:

  • The research shows that the combination of Domain Name System, Active Directory, and Dynamic Host Configuration Protocol could pose a cybersecurity risk.
  • The post provides an intricate guide on constructing the exploit, offering ample information on preventive measures.

Akamai Technologies Inc.’s security researcher Ori David recently cautioned in a blog post that the amalgamation of the Domain Name System, Active Directory, and Dynamic Host Configuration Protocol poses a potential cybersecurity threat.

The issue stems from how Microsoft Corp. assembled the DNS DHCP Dynamic Updates. DHCP is an efficient protocol that automates the assignment of TCP/UIP addresses across a network to prevent any address conflicts among devices. The dynamic update feature permits a DHCP server to generate or modify DNS records for any connected clients.

The critical terms in that statement – and the core of the threat – are “modify” and “any,” providing significant power to a potential attacker. This is due to the deliberate design, not a result of any bug or oversight by Microsoft, allowing these dynamic updates to occur without additional authentication from the client.

David wrote, “With DHCP DNS Dynamic Updates, we get the best of both worlds — the attack works on victims outside the LAN, and doesn’t require any authentication. Akamai researchers were also able to overwrite existing DNS records, and thus be able to send network traffic to their own servers.”

Although this may appear to be a relatively obscure issue, it is not. Given the widely used Microsoft DHCP services, there may be many potentially impacted organizations. According to David’s estimation, these services operate in 40% of all networks monitored by Akamai, a substantial portion of which are located in sizable corporate data centers.

The blog post delves into intricate details on constructing the exploit. It offers comprehensive guidance on prevention measures, including disabling DHCP DNS dynamic updates and steering clear of the use of DNS update proxy groups. One aspect of the matter is that despite Akamai notifying Microsoft of their discoveries, the latter has no intention of addressing the issue.

An obstacle arises in catering to outdated Windows NTv4.0 clients. As David noted, “If you have anything of that vintage running on your network, you’ve got bigger problems.” Akamai provides a link to a specialized PowerShell tool that can be utilized to assess potential risks associated with DNS misconfigurations.

David added, “The impact of the attacks that we highlighted can be very significant — the ability to overwrite DNS records without any authentication enables attackers to gain a machine-in-the-middle position on hosts in the domain. In most cases, the ability to intercept communication destined for the DHCP server could be abused to intercept credentials and relay them or capture sensitive traffic of other services that might be installed on the server. This could easily expose sensitive information and could allow attackers to breach AD domains and escalate privileges.”