Cybercrime

Emerging Cyber-Security Threats and Implications for the Private Sector

The new gTLD program will have a profound impact on the private sector's increasing dominance over Internet information resources and ownership of critical registry technical infrastructure assets. It is already anticipated that only the private sector will take full advantage of the commercial possibilities... However, the successful introduction of new gTLDs will also create new challenges of security for the private sector. more

Temporary Restraining Order Issued Against Domainer’s Use of “mylennar.com”

Companies sometimes find that opportunistic purchasers of domain names (often referred to as "domainers"), will purchase a domain name quite similar to that of the company, and establish a site at the URL loaded with revenue-generating sponsored ads. To accomplish these purposes, domainers seem to prefer the services of companies like HitFarm and Domain Sponsor. A web user types in the confusingly similar URL and is bombarded with pop-up ads and sponsored links to goods and services, often competitive to the company whose name or trademark is being appropriated in the URL... more

Close to Half of US East Coast Fuel Supply Shutdown Due to Ransomware Cyberattack

Colonial Pipeline, which accounts for close to half of the United States East Coast's fuel, has shut down its operations due to a cyberattack. The incident, believed to be the largest successful cyberattack on oil infrastructure in the U.S., was disclosed over the weekend. more

Paul Vixie on How the Openness of the Internet Is Poisoning Us

In a video interview conducted during the NSCS ONE conference, Paul Vixie CEO of Farsight Security further discusses the topic of his presentation titled: "Defective by Design -- How the Internet's Openness is Slowly Poisoning Us". more

2.6 Billion Records Were Stolen, Lost or Exposed Worldwide in 2017, an 88% Increase From 2016

Over the past five years, nearly 10 billion records have been lost, stolen or exposed, with an average of five million records compromised every day. more

Why Are the EU Data Protection Authorities Taking Away Our Fundamental Right to be Safe?

What if we created a rule that gave everyone - good or bad - the right to hide their license plate, where they live, who they are, and just go incognito? What if we made it a right to walk into any building in the world, and simply say "No, thank you" when the security guards asked for one's identification? The criminals would celebrate, and we'd all be utterly alarmed. We would immediately be afraid for our personal safety. more

Domain Name Theft Part II: Did ICANN Leave Foxes Guarding the Chicken COOP?

When it comes to stealing domain names, I suspect that there are two reasons why so many web bandits appear to be immune from ICANN (the Internet Corporation for Assigned Names and Numbers uses the acronym ICANN): the first reason I discussed in my last column on domain name theft (where I described a substantive void in domain name "regulation" as a primary factor for the increasing incidence of domain name theft), the second reason, which is the focus of this column, is the procedural anomaly that currently infuses ICANN's uniform dispute resolution process (UDRP) by providing no administrative forum for domain name registrants who become victims of domain name theft carried out by ICANN's registrars. more

Former Rutgers University Student and Two Other Men Plead Guilty to 2016 Mirai Botnet Attacks

A New Jersey man was one of the three who pled guilty to hacking charges and creating the massive Mirai botnet attacks which spread via vulnerabilities in IoT devices causing massive DDoS attacks. more

June Court Decision Detrimental to Domaining Practices

In a June court ruling, domainer Navigation Catalyst and registrar Basic Fusion lost a cybersquatting lawsuit to Verizon... This is an extremely interesting and potentially precedent-setting case regarding domaining and domain name tasting. The court condemns both practices, leading to a preliminary injunction against the domainer and its registrar based on the Anti-Cybersquatting Consumer Protection Act (ACPA). As far as I can recall, this is the first time that a domainer has lost an ACPA lawsuit in court, and it provides an important data point confirming that domaining can be cybersquatting (a previously unresolved issue)... more

Botnets Shift Focus to Credential Abuse, Says Latest Akamai Report

Akamai's Fourth Quarter, 2017 State of the Internet, was released today in which it states that the analysis of more than 7.3 trillion bot requests per month has found a sharp increase in the threat of credential abuse, with more than 40 percent of login attempts being malicious. more

Preliminary Thoughts on the Equifax Hack

As you've undoubtedly heard, the Equifax credit reporting agency was hit by a major attack, exposing the personal data of 143 million Americans and many more people in other countries. There's been a lot of discussion of liability; as of a few days ago, at least 25 lawsuits had been filed, with the state of Massachusetts preparing its own suit. It's certainly too soon to draw any firm conclusions... but there are a number of interesting things we can glean from Equifax's latest statement. more

Why Isn’t Mobile Malware More Popular?

This is a followup to Wout de Natris' as usual excellent piece on the Enisa botnet report -- pointing out the current state of mobile malware and asking some questions I started off answering in a comment but it grew to a length where I thought it'd be better off in its own post. Going through previous iterations of Mikko's presentations on mobile malware is a fascinating exercise. more

Wikileaks DDoS of Spamhaus: Political Activism at Its Dumbest

A week ago, Paul Vixie wrote a thoughtful piece on the morality of DDos, for both sides of the equation of the Wikileaks issues. In it he summarizes things nicely: "Denial of service is not merely a peaceful protest meant to garner attention for a cause. Denial of service is forcible and it is injurious. It is not like any form of civil disobedience, but rather it is criminal behaviour more like looting." Well said, Paul... more

Exposing A Famous Secret: Well-known Trademarks Are Not Easily Diluted

Regarding a domain name dispute involving famous authors, the novelist, Louis Sachar, observed that "if some unrelated person is going to co-opt my name in cyberspace, and fails to use it to identify a web site related to my books or myself, that's going to endanger my career, as well as my reputation." Louis Sachar is one of nine famous authors for whom the Authors Guild, recently successfully snatched personal name domain names from a United Kingdom domain name registrant known as Old Barn Studios... more

The Highest Threat TLDs - Part 2

In the first article of this two-part blog series, we looked at how frequently domains were used by bad actors for phishing activity across individual top-level domains (TLDs) or domain extensions, using data from CSC's Fraud Protection services, powered by our DomainSecSM platform. In this second article, we analyze multiple datasets to determine the highest-threat TLDs, based on the frequency with which the domains are used egregiously for a range of cybercrimes. more