Several South African organizations using Windows domain controllers have made a critical error, exposing their internal network traffic to potential attackers.
The issue arises when network administrators configure Microsoft Active Directory using an external Internet domain name they do not own for their internal domain. This results in a "namespace collision," where domain names intended solely for internal company use overlap with publicly accessible domains on the Internet.
For example, many years ago, a company may have set up its Windows domain using a name like "company.tech" when such a domain couldn't be publicly registered. However, with the launch of the .tech top-level domain (TLD) in 2015, it became possible to register "company.tech" on the Internet, allowing attackers to intercept internal network traffic.
This vulnerability stems from how Microsoft handles domain name resolution in Active Directory environments. In organizations using Windows Server, Active Directory manages identity and access, with domain-joined computers potentially "leaking" internal traffic due to a feature called DNS devolution. This feature simplifies access to resources by allowing users to omit the full domain name when searching for servers and services, but it also increases the risk of namespace collisions.
If an attacker registers an external domain that matches an internal domain, they could potentially intercept network traffic, gaining access to information about users, servers, and mapped drives. Such information could then be used for malicious purposes, including data theft, ransomware attacks, or the installation of malware.
Philippe Caturegli, founder of the security consultancy Seralys, has been working to raise awareness of this issue. He has been scanning TLDs to identify unregistered domains that organizations may be using for internal networks. Commonly used TLDs include .ad, .cloud, .tech, .systems, and .global, many of which were introduced in the 2010s, long after these organizations began using them internally.
Caturegli discovered that Woodlands Dairy, a major South African company, was using an unregistered domain name for its internal network. To prevent attackers from exploiting this vulnerability, he registered the domain at his own expense. After informing Woodlands Dairy of the issue in April, he initially received a positive response, but communication lapsed. Concerned that the domain would become vulnerable again once the registration expired, Caturegli followed up multiple times.
Eventually, Woodlands Dairy arranged to transfer the domain into its control and compensated Caturegli for his costs. While this issue was resolved, Caturegli noted that Woodlands Dairy is not the only South African company at risk. Other organizations may still be using unregistered internal domains, leaving their networks exposed to potential attacks.
MyBroadband has reached out to these companies to inform them of the risk.
Elevate your cybersecurity strategy with NIST Audit and cutting-edge services inspired by the insights of Cybersecurity Futures 2030. Trust our expertise to navigate the dynamic landscape and secure a thriving digital future. Your defense starts here!