AI amplifies dangling DNS takeover risks, research shows

A dangling DNS takeover attack, where a subdomain record points to a deleted cloud resource, has been amplified by artificial intelligence, according to new research. This method, previously used for financial gain, now presents a significant threat for disruption and chaos, as reported by Security Week.

Security firm Silent Push's research, dubbed "DangleGeddon," utilized AI to massively expand the discovery of vulnerable domains and subdomains. AI assisted in generating takeover scripts and filtering exploitable targets from a dataset of 12,500 domains down to several hundred. This broadened the attack surface beyond human capabilities, enabling rapid infrastructure build-out for exploitation.

The research highlighted potential impacts across various sectors. For the U.S. federal government, it could lead to phishing pages bypassing trust filters on .gov domains. In banking, a global application could paralyze online services and trading platforms for multinational firms. For manufacturing, it could compromise supply chains by hosting malicious content under legitimate domains. In pharmaceuticals, it could disrupt R&D and clinical trials, with potential losses in the hundreds of billions.

The research suggests that while nation-states could leverage this for geopolitical disruption, individual cybercriminals could also use AI for monetization. The core message emphasizes the critical need for organizations to eliminate dangling DNS records to prevent abuse.

Source: Security Week