diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 41c0720c1a..b7a1e1a203 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -30,6 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update GCP Cloud Storage service metadata to new format [(#9640)](https://github.com/prowler-cloud/prowler/pull/9640) - Update GCP Compute Engine service metadata to new format [(#9641)](https://github.com/prowler-cloud/prowler/pull/9641) - Update GCP Dataproc service metadata to new format [(#9642)](https://github.com/prowler-cloud/prowler/pull/9642) +- Update GCP DNS service metadata to new format [(#9643)](https://github.com/prowler-cloud/prowler/pull/9643) ### 🔐 Security diff --git a/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.metadata.json b/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.metadata.json index c0c0295695..81b7a96509 100644 --- a/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.metadata.json +++ b/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.metadata.json @@ -1,30 +1,40 @@ { "Provider": "gcp", "CheckID": "dns_dnssec_disabled", - "CheckTitle": "Ensure That DNSSEC Is Enabled for Cloud DNS", + "CheckTitle": "Cloud DNS managed zone has DNSSEC enabled", "CheckType": [], "ServiceName": "dns", "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "DNS_Zone", - "ResourceGroup": "network", - "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.", - "Risk": "Attackers can hijack the process of domain/IP lookup and redirect users to malicious web content through DNS hijacking and Man-In-The-Middle (MITM) attacks.", + "ResourceType": "dns.googleapis.com/ManagedZone", + "Description": "**Cloud DNS managed zones** are assessed for **DNSSEC** status. Zones with DNSSEC sign zone data and publish `DNSKEY`/`RRSIG`; zones without it remain unsigned and unauthenticated.", + "Risk": "Without **DNSSEC**, DNS responses lack authenticity, enabling cache poisoning, spoofed referrals, and domain hijacking. Victims may be redirected to attacker hosts, exposing credentials and data (confidentiality), enabling tampered content and records (integrity), and causing misrouting or outages (availability).", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudDNS/enable-dns-sec.html", + "https://cloud.google.com/dns/docs/dnssec-config", + "https://cloud.google.com/sdk/gcloud/reference/dns/managed-zones/create?authuser=4", + "https://cloud.google.com/dns", + "https://docs.cloud.google.com/dns/docs/dnssec", + "https://cloud.google.com/dns/docs/dnssec-config?hl=vi", + "https://cloud.google.com/dns/docs/registrars?hl=Es" + ], "Remediation": { "Code": { "CLI": "gcloud dns managed-zones update --dnssec-state on", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudDNS/enable-dns-sec.html", - "Terraform": "https://docs.prowler.com/checks/gcp/google-cloud-networking-policies/bc_gcp_networking_5#terraform" + "Other": "1. In the Google Cloud Console, go to Cloud DNS\n2. Click the managed zone name\n3. Click Edit\n4. Under DNSSEC, select On\n5. Click Save", + "Terraform": "```hcl\nresource \"google_dns_managed_zone\" \"\" {\n name = \"\"\n dns_name = \"example.com.\"\n\n dnssec_config {\n state = \"on\" # Critical: enables DNSSEC for the managed zone\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that DNSSEC security feature is enabled for all your Google Cloud DNS managed zones in order to protect your domains against spoofing and cache poisoning attacks. By default, DNSSEC is not enabled for Google Cloud public DNS managed zones. DNSSEC security feature helps mitigate the risk of such attacks by encrypting signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect web clients to fake, fraudulent or scam websites.", - "Url": "https://cloud.google.com/dns/docs/dnssec-config" + "Text": "Enable **DNSSEC** on public zones and complete the chain of trust by publishing a `DS` record at your registrar. Use DNSSEC-validating resolvers, apply **least privilege** for DNS administration, and monitor key lifecycle events. *Private zones are not DNSSEC-signed.*", + "Url": "https://hub.prowler.com/check/dns_dnssec_disabled" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.metadata.json b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.metadata.json index 85a739f425..64a75179d3 100644 --- a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.metadata.json +++ b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.metadata.json @@ -1,30 +1,38 @@ { "Provider": "gcp", "CheckID": "dns_rsasha1_in_use_to_key_sign_in_dnssec", - "CheckTitle": "Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC", + "CheckTitle": "Cloud DNS managed zone DNSSEC key-signing key does not use RSASHA1", "CheckType": [], "ServiceName": "dns", "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "DNS_Zone", - "ResourceGroup": "network", - "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.", - "Risk": "SHA1 is considered weak and vulnerable to collision attacks.", + "ResourceType": "dns.googleapis.com/ManagedZone", + "Description": "**Cloud DNS zones** are assessed for DNSSEC **Key-Signing Key (KSK)** algorithms, specifically detecting use of `rsasha1`. Zones with KSKs on modern algorithms are distinguished from those still using `rsasha1`.", + "Risk": "Using `rsasha1` for KSK weakens DNSSEC. Collision-based forgeries can enable signed record spoofing, resulting in domain hijack, cache poisoning, and redirection-compromising **integrity** and **confidentiality**. Some validators reject SHA-1, causing resolution errors and reduced **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudDNS/dns-sec-key-signing-algorithm-in-use.html", + "https://cloud.google.com/dns/docs/dnssec-config", + "https://docs.cloud.google.com/dns/docs/dnssec-config", + "https://cloud.google.com/dns/docs/dnssec-advanced?hl=id", + "https://docs.cloud.google.com/dns/docs/dnssec-advanced" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "gcloud dns managed-zones update --dnssec-state on --ksk-algorithm RSASHA256 --ksk-key-length 2048 --zsk-algorithm RSASHA256 --zsk-key-length 1024", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudDNS/dns-sec-key-signing-algorithm-in-use.html", - "Terraform": "https://docs.prowler.com/checks/gcp/google-cloud-networking-policies/bc_gcp_networking_6#terraform" + "Other": "1. In Google Cloud Console, go to Networking > Cloud DNS and open the affected managed zone\n2. Click Edit\n3. If DNSSEC is enabled, set DNSSEC to Off and Save; then click Edit again\n4. Set DNSSEC to On, expand Advanced options\n5. Set Key-signing key (KSK) algorithm to RSASHA256 (not RSASHA1); set Zone-signing key (ZSK) algorithm to RSASHA256\n6. Click Save", + "Terraform": "```hcl\nresource \"google_dns_managed_zone\" \"\" {\n name = \"\"\n dns_name = \"example.com.\"\n\n dnssec_config {\n state = \"on\"\n\n default_key_specs {\n key_type = \"keySigning\"\n algorithm = \"rsasha256\" # FIX: use a non-RSASHA1 KSK algorithm to pass the check\n key_length = 2048\n }\n\n default_key_specs {\n key_type = \"zoneSigning\"\n algorithm = \"rsasha256\"\n key_length = 1024\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that Domain Name System Security Extensions (DNSSEC) feature is not using the deprecated RSASHA1 algorithm for the Key-Signing Key (KSK) associated with your DNS managed zone file. The algorithm used for DNSSEC signing should be a strong one, such as ECDSAP256SHA256 algorithm, as this is secure and widely deployed, and therefore it is a good choice for both DNSSEC validation and signing.", - "Url": "https://cloud.google.com/dns/docs/dnssec-config" + "Text": "Adopt **strong, supported DNSSEC algorithms** for KSKs (e.g., `ECDSAP256SHA256` or `RSASHA256`) and retire `rsasha1`. Rotate keys and validate changes before deployment. Keep KSK and ZSK algorithms consistent, document key-rotation policy, and enforce **least privilege** for DNS/DNSSEC administration.", + "Url": "https://hub.prowler.com/check/dns_rsasha1_in_use_to_key_sign_in_dnssec" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.metadata.json b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.metadata.json index 7b8f0cb59d..356869799d 100644 --- a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.metadata.json +++ b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.metadata.json @@ -1,30 +1,39 @@ { "Provider": "gcp", "CheckID": "dns_rsasha1_in_use_to_zone_sign_in_dnssec", - "CheckTitle": "Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC", + "CheckTitle": "Cloud DNS managed zone does not use the RSASHA1 algorithm for the DNSSEC zone-signing key", "CheckType": [], "ServiceName": "dns", "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "DNS_Zone", - "ResourceGroup": "network", - "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.", - "Risk": "SHA1 is considered weak and vulnerable to collision attacks.", + "ResourceType": "dns.googleapis.com/ManagedZone", + "Description": "**Cloud DNS** DNSSEC settings are inspected for the **zone-signing key algorithm**. Zones that use `rsasha1` for zone signing are identified.", + "Risk": "Using **RSASHA1 for DNSSEC zone signing** weakens record integrity due to known **collision attacks**. Some validating resolvers no longer accept `SHA-1`, causing **resolution failures**. Adversaries may forge `RRSIGs`, enabling **DNS hijacking** or cache poisoning and redirecting traffic.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudDNS/dns-sec-zone-signing-algorithm-in-use.html", + "https://cloud.google.com/dns/docs/dnssec-config", + "https://cloud-kb.sentinelone.com/dns-security-rsa-sha1-enabled", + "https://datatracker.ietf.org/doc/html/rfc9905", + "https://stackoverflow.com/questions/68968312/terraform-errors-deploying-google-dns-managed-zone-with-rsasha1", + "https://docs.datadoghq.com/security/default_rules/def-000-jud/" + ], "Remediation": { "Code": { "CLI": "", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudDNS/dns-sec-zone-signing-algorithm-in-use.html", - "Terraform": "https://docs.prowler.com/checks/gcp/google-cloud-networking-policies/bc_gcp_networking_6#terraform" + "Other": "1. In Google Cloud Console, go to Networking > Network services > Cloud DNS\n2. Click the managed zone name, then click Edit\n3. If DNSSEC is On and the Zone signing algorithm is RSASHA1: set DNSSEC to Off and Save\n4. Click Edit again, set DNSSEC to On\n5. Open Advanced settings, set Zone signing algorithm to ECDSAP256SHA256 (or RSASHA256)\n6. Click Save", + "Terraform": "```hcl\nresource \"google_dns_managed_zone\" \"\" {\n name = \"\"\n dns_name = \"example.com.\"\n\n dnssec_config {\n state = \"on\"\n\n default_key_specs {\n algorithm = \"ecdsap256sha256\" # FIX: use a secure algorithm for zone signing\n key_type = \"zoneSigning\" # Ensures the zone-signing key is not RSASHA1\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that Domain Name System Security Extensions (DNSSEC) feature is not using the deprecated RSASHA1 algorithm for the Zone-Signing Key (ZSK) associated with your public DNS managed zone. The algorithm used for DNSSEC signing should be a strong one, such as RSASHA256, as this algorithm is secure and widely deployed, and therefore it is a good candidate for both DNSSEC validation and signing.", - "Url": "https://cloud.google.com/dns/docs/dnssec-config" + "Text": "Use **strong DNSSEC algorithms** for zone signing (e.g., `rsasha256`, `ecdsa-p256-sha256`, `ed25519`) and avoid `rsasha1`. Practice **crypto agility**: standardize secure defaults, rotate keys, and periodically validate signatures with modern resolvers. Apply **defense in depth** by monitoring DNSSEC health and limiting who can change settings.", + "Url": "https://hub.prowler.com/check/dns_rsasha1_in_use_to_zone_sign_in_dnssec" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": ""