Cybercrime

A Bigger Boat: Application Security Outgrows Capacity for CIOs

There is a classic scene in the movie, "Jaws," when Roy Scheider gets a look at the size of the shark circling his fishing vessel and says, "We're going to need a bigger boat." The same case can be made for CIOs dealing today with application security. Hackers from all over the world are circling business and government like great whites looking for vulnerabilities in Internet-facing applications. The growth of applications is great for doing business but they have become chum in the water for predators. more

Cybercriminals Benefitting from Stalled Privacy/Proxy Policy

We've seen alarmingly BIG increases in multiple abusive behaviors – like phishing, hacking and malware – that often leverage the domain name system (DNS) and privacy/proxy services. Cybercriminals capitalize on gaps in DNS security measures, and ICANN is holding the door open for them by failing to implement their privacy/proxy policy. If you are ever targeted, you are not alone. more

COVID-19, WHOIS, and the Pressing Need for Help With Domain Name System Abuse

As widely reported, and not surprising, the internet is swimming in COVID-19 online scams. Criminals, accustomed to rapidly grabbing online territory during times of crisis and profiting from public fear, are working overtime in the face of the coronavirus. Unfortunately, ICANN's failure to enforce its minimal WHOIS and DNS abuse requirements has resulted in delayed mitigation efforts at a time when swift responses are needed to protect the public from COVID-19 scams. more

Proposed Changes to Australia’s Data Retention Laws Likely to Be Costly

Australians may lose their right to privacy online if the attorney-general has her way. Nicola Roxon's discussion paper is before a parliamentary inquiry. Proposals include storing the social media and other online and telecommunications data of Australians for two years, under a major overhaul of Australia's surveillance laws. The government passed a toned down version of these proposals last week, giving police the power to force telcos to store data on customers for a specific period while a warrant is sought. more

A Bad Year for Phishing

Here at the Anti-Phishing Working Group meeting in Hong Kong, we've just released the latest APWG Global Phishing Survey. Produced by myself and my research partner Rod Rasmussen of Internet Identity, it's an in-depth look at the global phishing problem in the second half of 2013. Overall, the picture isn't pretty. There were at least 115,565 unique phishing attacks worldwide during the period. This is one of the highest semi-annual totals we've observed since we began our studies in 2007. more

High Performance DNS Needs High Performance Security

There's been a lot of emphasis on DNS performance lately because faster DNS contributes directly to a better user experience. There's an interesting flipside to DNS performance though, higher performance DNS servers may be better targets for cache poisoning attacks. Faster servers give attackers more opportunities to insert fake entries into the DNS - speed can kill (or at least inflict a nasty wound!) so it's important to understand the security implications if you're looking to upgrade DNS performance. more

Yahoo Reveals Over One Billion More Accounts Have Been Hacked

Just a few months after Yahoo confirmed a massive data breach impacting half a billion users, the company today disclosed a second major breach of its systems affecting over a billion users. more

Unpacking the Framework to Address DNS Abuse

As the Internet has grown, so too have the abuses that go along with one of the world's most transformative technologies. For all of the positives the Internet brings, negatives like phishing, malware and child exploitation are a reality online. As of December 9, 2019, 48 registrars and registries have signed onto the "Framework to Address Abuse." This initiative was launched last month by a number of domain name registries and registrars, just prior to the ICANN meeting in Montreal. more

Public Sharing and a New Strategy in Fighting Cyber Crime

A couple of years ago I started a mailing list where folks not necessarily involved with the vetted, trusted, closed and snobbish circles of cyber crime fighting (some founded by me) could share information and be informed of threats. In this post I explore some of the history behind information sharing online, and explain the concept behind the botnets mailing list... we may not be able to always share our resources, but it is time to change the tide of the cyber crime war, and strategize. One of the strategies we need to use, or at least try, is public information sharing of "lesser evils" already in the public domain. more

NTIA Seeks Nominations to Serve on the Online Safety and Technology Working Group

In the midst of the election season, Congress passed a plethora of Internet related laws. Most involved child protection. One involved webcaster protection. Wasting no time, the impact of the new laws is already being felt through federal agency implementation. On Friday, the National Telecommunications and Information Administration (NTIA) in the Department of Commerce released the following notice... more

Provoking National Boundaries on the Internet? A chilling thought…

The impact of the recently revealed US government data collection practices may go well beyond the privacy ramifications outlined in the Internet Society's statement: expect a chilling effect on global, resilient network architecture. As governments of other countries realize how much of their citizens' traffic flows through the US, whether or not it is destined for any user or service there, expect to see moves to curtail connections to and through the US. more

Time for Self Reflection

In case you don't read any of what I have to say below, read this: I have dual citizenship. Along with my homeland citizenship, I am of the Internet, and see it as my personal duty to try and make the Internet safe. Atrivo (also known as Intercage), is a network known to host criminal activity for many years, is no more. Not being sarcastic for once, this is the time for some self reflection. more

UN Treaty Threatens Cybersecurity, Warns Google

As governments convene to discuss the UN Cybercrime Treaty, Google is urging caution, warning that the current draft could endanger online security and free expression.  more

Five Security Blind Spots from Prolonged Implementation of a Business Continuity Plan Amid COVID-19

The novel coronavirus outbreak (COVID-19) has prompted many organizations in Mainland China and Hong Kong to execute their business continuity plan (BCP). During the last epidemic in 2003, the SARS outbreak lasted for nine months – and with an infection rate that is increasing rapidly, this new coronavirus has the potential to cause prolonged periods of commercial disruption, and heavy reliance on BCPs. more

WIPO Snafu Over britishmuseum.org Case?

WIPO just published a decision regarding the domain dispute over the britishmuseum.org domain name. At first glance, everything seems alright. The world famous British Museum won in a default judgment as the current registrant (the respondent) never replied). However, drill a little deeper and something is amiss. The "parties" section of the case lists the respondent as "British Museum Resources, Limited, West Bay, George Town, Kentucky, United States of America." more