# Black Hat 2021: DNS loophole makes nation-state level spying as easy as registering a domain

Registering a hosted zone named after a shared AWS/Google nameserver hijacked Windows dynamic DNS updates, leaking internal IPs, hostnames and employee data from 15,000 orgs.

- Payout: Research
- Severity: high
- Program: AWS Route
- Credited: Wiz Research
- Disclosed: 2021-08-04
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain
- Tags: domain:cloud domain:network impact:data-leak impact:internal-access kind:research platform:threat-intel sev:high tech:aws tech:windows technique:recon vuln:info-disclosure vuln:misconfiguration

**Target:** Managed DNS provider (AWS Route 53 / Google Cloud DNS) shared nameservers
**Root cause:** Managed DNS providers don't verify domain ownership, so a customer can register a hosted zone whose name equals a shared nameserver's own hostname; the provider then serves attacker-controlled records for that name to all tenants. Windows dynamic DNS fallback queries the nameserver about itself and follows the poisoned answer.
**Steps:**
1. Create hosted zone on Route53 named `ns-852.awsdns-42.net` inside nameserver `ns-1611.awsdns-09.co.uk`
2. Ensure the registered nameserver is managed by the same server it names (repeat across ~2,000 AWS nameservers)
3. Point the hosted zone's A record to attacker IP `1.3.3.7`
4. Windows endpoint fails dynamic update to master server, falls back to querying its nameservers for the master's record
5. Nameserver returns attacker IP; endpoint sends dynamic update (internal IP, computer name) to attacker
6. Collect and analyze inbound traffic from millions of endpoints
**How found:** Reasoned that DNS hosting platforms assume tenant isolation and don't verify ownership; hypothesized that registering the nameserver's own name as a hosted zone would break isolation, then tested by registering such zones and observing inbound traffic.
**Exploitation:** Attacker registers special hosted zones matching shared nameserver hostnames, directs them to a controlled IP, and passively harvests dynamic DNS update traffic from Windows endpoints of thousands of organizations, yielding internal/external IPs, hostnames, employee names and office locations for attack planning.
**Escalation:** Data used to map employee/office locations across 40,000 endpoints and identify sanctions-violating operations; intel enables targeted intrusion.
**Insight:** On multi-tenant SaaS/DNS platforms, try registering resource names that collide with the provider's own infrastructure identifiers (nameserver hostnames, internal service names) — isolation assumptions often break when a tenant-controlled name shadows a provider-owned name.