Private DNS zones, resolver forwarding rules, or the DNS servers handed out through DHCP may be created or modified so that names resolve to addresses controlled by an unauthorized entity. Resources connect to the wrong destination and credentials or data are exposed to that destination, impacting the confidentiality and integrity of data.
DNS Resolution is Hijacked to Redirect Traffic
CCC.VPC.TH11
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CP14 | Built-in DNS Resolution | The service automatically resolves hostnames to IP addresses for resources within the virtual network, allowing resources to communicate using hostnames instead of IP addresses. |
| CCC.VPC.CP15 | Built-in DHCP Assignment | The service automatically assigns IP addresses, subnet masks, default gateways, and other network configuration to resources within the virtual network. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CN07 | Alert on Changes That Redirect or Expose Traffic | Ensure that a route change exposing a private subnet or a change to the DNS servers used by resources is published to a monitored channel, so that traffic cannot be redirected or exposed unobserved. |