Partnered With:

Frax Finance has also fallen victim to DNS domain hijacking, with four such incidents occurring in the past two months in the Web3 space.

Joyce

Read this article in 9 Minutes

Founder urgently tweeted and questioned the domain service provider in the comments, "Can you guys hurry?"

Table of Contents

· Domain name suffers from DNS hijacking, founder urgently tweets to remind users

· Recent frequent occurrences of DNS hijacking incidents

· What is DNS hijacking?

BlockBeats News, on November 1st, according to PeckShield's monitoring, the DNS of the hybrid algorithm stablecoin protocol Frax Finance website was suspected to have been hijacked.

Domain name hijacked by DNS, founder urgently tweets to remind users

On the morning of November 1st, Frax Finance, the leading protocol in the stablecoin industry, which utilizes a hybrid algorithm stablecoin protocol, was attacked by DNS hijacking.

Founder Sam Kazemian tweeted, "If anyone has any contact information, please DM @namedotcom. Also, do not use http://frax.finance until we retrieve the domain."

The domain name service provider Name.com, called by Sam, responded under the tweet, saying that they are investigating. From Sam's response, it can be understood that the attack may have lasted for 1 hour by the time the founder urgently posted the tweet.

Recent DNS hijacking incidents have occurred frequently

In 2022, protocols such as Curve Finance, Convex Finance, cBridge, Polygon RPC Gateway, and Ribbon Finance experienced DNS hijacking attacks. In the Curve Finance attack, over $600,000 was stolen.

Recently, there has been a surge in DNS attack incidents in the past two months. On September 20th, Balancer suffered from DNS hijacking attacks, resulting in a loss of $238,000.

On October 6th, Galxe's front-end website was hit by a DNS attack, and the hacker's address obtained over $160,000 in user funds. On the same day, the blockchain toolbox MCT announced that some users reported their MCT wallets being stolen in the past two days. After investigation, it was found that due to DNS domain hijacking by the operator, under certain conditions, the pasted private key may be uploaded to a fake domain.

DNS hijacking, what is it?

DNS (Domain Name System) hijacking, also known as DNS redirection, is achieved by attackers disrupting DNS servers and changing the IP address associated with a specific domain name. As a result, users attempting to access a legitimate website are redirected to a fake website that appears identical but is controlled by the attacker. This means that any transactions initiated by the user on the fake website will be executed using the attacker's smart contract instead of the legitimate one.

In 2022, after Curve Finance was hit by a DNS attack, SlowMist Cosine published an article explaining the reasons for and preventive measures against DNS hijacking.

There are two types of common DNS hijacking: the domain control panel is hacked, and the attacker can arbitrarily modify the DNS A record (pointing the IP to the attacker-controlled IP_BAD), or directly modify the Nameservers to the attacker-controlled DNS server; doing rough man-in-the-middle hijacking on the network, forcing the target domain to point to IP_BAD.

The first type of hijacking can achieve silent hijacking, that is, the user's browser side will not have any security prompts, because the attacker can issue another legitimate HTTPS certificate. In the case of the second type of hijacking, when the domain uses HTTPS, an HTTPS certificate error prompt will appear, and it cannot be silently hijacked, but the user can force to continue accessing, unless the target domain is configured with the HSTS security mechanism.

For users, defense points include: For critical domains, do not access them in HTTP form, such as: http://example[.]com

Instead, always use HTTPS form: https://example[.]com

If an HTTPS certificate error occurs after accessing in HTTPS form, then do not continue to access. This can resist non-silent DNS hijacking attacks.

For silent hijacking situations, whether it is DNS hijacking, project server hacking, internal malice, or project front-end code being attacked by the supply chain, from the user's perspective, there will be no exceptions on the browser side until a user's assets are stolen. In this case, users can try to use browser security extension attacks, but the most important thing is to maintain vigilance for every step of the operation (especially the moment when the wallet needs to be signed and confirmed).

Of course, in the Web3 field, it is also important to keep an eye on the information released by the project party in a timely manner.