Home / Blogs

AOL Has a Security Hole, and It’s Our Problem

Protect your privacy:  Get NordVPN  [ Deal: 73% off 2-year plans + 3 extra months ]
10 facts about NordVPN that aren't commonly known
  • Meshnet Feature for Personal Encrypted Networks: NordVPN offers a unique feature called Meshnet, which allows users to connect their devices directly and securely over the internet. This means you can create your own private, encrypted network for activities like gaming, file sharing, or remote access to your home devices from anywhere in the world.
  • RAM-Only Servers for Enhanced Security: Unlike many VPN providers, NordVPN uses RAM-only (diskless) servers. Since these servers run entirely on volatile memory, all data is wiped with every reboot. This ensures that no user data is stored long-term, significantly reducing the risk of data breaches and enhancing overall security.
  • Servers in a Former Military Bunker: Some of NordVPN's servers are housed in a former military bunker located deep underground. This unique location provides an extra layer of physical security against natural disasters and unauthorized access, ensuring that the servers are protected in all circumstances.
  • NordLynx Protocol with Double NAT Technology: NordVPN developed its own VPN protocol called NordLynx, built around the ultra-fast WireGuard protocol. What sets NordLynx apart is its implementation of a double Network Address Translation (NAT) system, which enhances user privacy without sacrificing speed. This innovative approach solves the potential privacy issues inherent in the standard WireGuard protocol.
  • Dark Web Monitor Feature: NordVPN includes a feature known as Dark Web Monitor. This tool actively scans dark web sites and forums for credentials associated with your email address. If it detects that your information has been compromised or appears in any data breaches, it promptly alerts you so you can take necessary actions to protect your accounts.

Two weeks ago I wrote about Yahoo’s unfortunate mail security actions. Now it’s AOL’s turn, and the story, as best as I can piece it together, is not pretty.

Yahoo used an emerging system called DMARC, which was intended to fight phishing of often forged domains like paypal.com. A domain owner can publish a DMARC “reject” policy which, oversimplifying a little, tells the world that if mail with their name on the ‘From:’ line didn’t come from their servers, it’s not from them so you should reject it.

While this policy is fine for Paypal, it was bad news when Yahoo did it over the weekend a few weeks ago, because there is a lot of mail with ‘yahoo.com’ on the ‘From:’ line that doesn’t come from Yahoo. The highest profile is discussion mailing lists, but there are others like newspaper mail-an-article buttons that put the address of the person sending the article on the ‘From:’ line, and various mail consolidation setups, like the one at Gmail that lets you collect mail from all your accounts in your Gmail inbox, and also send mail with the addresses of those accounts. (They check it’s really you before they let you do it, of course.) All those now don’t work reliably any more, when sending from a yahoo.com address, and as I explained in the previous article, cause considerable harm to innocent bystanders on other mail systems.

Now AOL just did the same thing, at least sending out a press release so we didn’t have to reverse engineer what they did. But it’s also now clear why Yahoo and AOL did this: it’s a band-aid for big security problems. I’ve been getting a lot of spam from aol.com addresses of people I know, with other people I know on the ‘To:’ line. This means that the crooks were using the AOL user’s address book. And when I look at the spam, most of it doesn’t come from AOL, but instead from other ISPs such as Orange, a French phone company, which means that the horse has left the barn, the crooks have stolen the AOL users’ address books and there’s nothing AOL can do about it. I am hardly the only one to notice this problem.

A friend (the always perceptive Steve Atkins) pointed out that Yahoo had the same problem earlier this year. This makes the DMARC actions more understandable, if not necessarily more excusable. Crooks are using the stolen address books to send spam, and the DMARC policy stops a fair amount of it, which is good. Unfortunately, in the process of slamming the barn door after the horse left, AOL and Yahoo have crushed a lot of small animals on the way.

At this point, I channel Colin Powell’s Pottery Barn Rule: You break it, you own it. It’s their mess, due to their security breaches, so it’s their responsibility to deal with the damage. All of their suggestions so far have the consistent theme that everyone one else spend their own time and money to change the way they work, and remove features their users depend on, to circumvent the DMARC damage. Yahoo estimates this affects 30,000 small mailers. Uh, no. Speaking as a mailing list operator, I’m willing, not eager, but willing, to work with the DMARC cartel to mitigate the damage, but they have to be willing to put some effort into it beyond waving their hands and telling us our mail volume is so tiny that we don’t matter. (If that’s the argument, the total traffic volume of all mail including the spam is a rounding error compared to video and P2P, so we should just shut all mail down, thereby solving the spam problem at a stroke. So let’s not go there.)

In the next and I hope final installment, I’ll suggest some short term and longer term ways that ISPs can use DMARC and preserve the mail services their users and everyone else counts on.

By John Levine, Author, Consultant & Speaker

Filed Under

Comments

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

New TLDs

Sponsored byRadix

Threat Intelligence

Sponsored byWhoisXML API

Domain Names

Sponsored byVerisign

DNS

Sponsored byDNIB.com

IPv4 Markets

Sponsored byIPv4.Global

Brand Protection

Sponsored byCSC

Cybersecurity

Sponsored byVerisign