DNS and Domain Hijacking

This article has three layers:

1. Layer 1: The Intuition: Changing the road signs
2. Layer 2: Real-World Use: DeFi frontend hijacking incidents, subdomain takeover
3. Layer 3: Principles and Engineering details

Layer 1: The Intuition

1.1 Changing the road signs

You drive to the same bank every day. One day, someone changes the road sign at the intersection to point toward another building that looks exactly like the original. You walk in as usual and deposit your money.

The bank itself is perfectly intact, but your money is gone. DNS is the road sign of the internet.

1.2 Who can change the road signs

Layer 2: Real-World Use

• DeFi Frontend DNS Hijacking (Multiple instances): In 2022, Curve Finance's DNS was tampered with; when users visited the official domain, they were directed to a fake frontend deployed by attackers, leading them to sign transactions that authorized tokens to the attacker. In 2024, during a domain registrar business migration, multiple DeFi projects (such as Compound, Celer, etc.) had their domains hijacked due to security setting issues following the migration.
• Social Engineering the Registrar: Attackers impersonate the domain owner and call or email the registrar's customer service to trick them into granting account control.
• Subdomain Takeover: A company once pointed blog.example.com to a resource on a cloud service (such as a static website hosting service), but the resource was later deleted while the DNS record remained. An attacker can register a resource with the same name on that cloud service to control the content of blog.example.com. This type of issue is very common in bug bounty programs.

The particular danger of DNS hijacking is that: attackers can also apply for legitimate HTTPS certificates for the hijacked domain (Certificate Authorities verify domain control via DNS or HTTP), so the small padlock in the browser address bar will still be displayed.

Layer 3: Principles and Engineering

3.1 Protecting Registrar Accounts

3.2 Protecting DNS Records

• DNS provider accounts also require strong 2FA and least-privilege API tokens (see "Least Privilege and Key Management");
• DNSSEC: Adds digital signatures to DNS records so resolvers can verify that records have not been tampered with during transmission. It prevents "Man-in-the-Middle DNS response forgery," but it cannot prevent an attacker from using legitimate methods to modify records after an account is compromised;
• CAA Record: Declares "only these specific Certificate Authorities are allowed to issue certificates for my domain," increasing the difficulty for attackers to request certificates;
• Certificate Transparency Monitoring: All publicly trusted certificates are written to public logs (see "Hash Chain Audit Logs"); subscribe to monitoring services to receive a notification as soon as someone requests a new certificate for your domain.

3.3 Preventing Subdomain Takeover

• When deleting cloud resources, delete the DNS record first, then delete the resource;
• Periodically scan all DNS records to check if the resources they point to still exist and are still owned by you;
• Use wildcard records as sparingly as possible.

3.4 Monitoring

3.5 Advice for Users

• For frequently used DeFi websites, you can use bookmarks, but be aware that bookmarks cannot prevent DNS hijacking (the domain remains the same);
• Wallet transaction decoding and risk warnings are the last line of defense: even if the website is fake, the wallet will still show exactly what you are signing (see "Blind Signing vs. What You See Is What You Sign");
• Pay attention to official announcements from project teams; they usually notify users immediately when a DNS event occurs.

Summary