Cybersecurity

DNS Amplification Attacks: Out of Sight, Out of Mind? (Part 2)

This post follows an earlier post about DNS amplification attacks being observed around the world. DNS Amplification Attacks are occurring regularly and even though they aren't generating headlines targets have to deal with floods of traffic and ISP infrastructure is needlessly stressed -- load balancers fail, network links get saturated, and servers get overloaded. And far more intense attacks can be launched at any time. more

EuroDIG Sessions on Friday, June 5, about Cybersecurity, Network Neutrality, IANA, Access and More

What do Europeans interested in Internet policy think about cybersecurity, network neutrality, IANA, improving Internet access and other topics? Tomorrow the second day of the European Dialog on Internet Governance (EuroDIG) 2015 in Sofia, Bulgaria, will cover all those topics and many more. I've listed some of the sessions that either I or my Internet Society colleagues are participating in. I will personally be involved as a panelist on the two sessions about cybersecurity. more

Corporate Espionage in the News: Hilton and the Oil Industry

Is anyone calling espionage by means of computers cyber-espionage yet? I hope not. At least they shouldn't call it cyber war. Two news stories of computerized espionage reached me today. The first, regarding the Oil industry, was sent by Marc Sachs to a SCADA security mailing list we both read. The second, about the hotel industry, was sent by Deb Geisler to science fiction convention runners (SMOFS) mailing list we both read. more

A Quick Look at the 4 Most Prevalent Types of Threat Intelligence

You won't go far with your cybersecurity when you're relying on the wrong intelligence. This is simply because not all types of threat intelligence are equal. You might have experienced this yourself; investing time and resources into just one only to receive meagre results in the end. Sadly, many organizations fail to realize that depending on just a single source of information is a big mistake. more

Survey Predicts Attacks on the Network Infrastructure Within 10 Years

Pew Internet Project has released a report called "The Future of the Internet" based on a recently conducted survey where 1,286 internet experts are said to have looked at the future impact of the internet and assessed predictions about how technology and society will unfold. The following is and excerpt from the report predicting at least one devastating attack will occur in the next 10 years on the networked information infrastructure or the United States power grid. more

ICANN And The DOC Can’t

The former contract with ICANN and the US Department of Commerce (DOC) was due to expire on September 30, 2002. In the statement announcing the renewal, the DOC acknowledged that ICANN was the subject of many complaints from many sectors of the Internet community. Some of these complaints had been presented to the US Congress during a hearing held in June 2002 by a Senate Subcommittee. At the hearing, a General Accounting Office (GAO) spokesperson, Peter Guerrero, testified, noting not only that ICANN had failed in its mandate, but that the U.S. Department of Commerce was also at fault in failing to properly oversee ICANN activities. He explains... more

Preventing DNS Strain When You Deploy DNSSEC

The barriers to DNSSEC adoption are quickly disappearing. There are nearly 20 top-level domains that have already deployed DNSSEC including generic TLDs like .org and .gov. This July, the DNS root will also be signed, and will begin validating. At this point, the decision for remaining TLDs to deploy DNSSEC is really no longer a question. more

Renowned Security Expert Bruce Schneier Joins EFF Board of Directors

Schneier's insight is considered particularly important according to EFF, as more and more is learnt "about the unconstitutional surveillance programs from the National Security Agency and the depth and breadth of data the NSA is collecting on the public." more

Protecting Customer Data

There have been a number of reports recently about customer lists leaking out through Email Service Providers (ESPs). In one case, the ESP attributed the leak to an outside hack. In other cases, the ESPs and companies involved have kept the information very quiet and not told anyone that data was leaked. People do notice, though, when they use single use addresses or tagged addresses and know to whom each address was submitted. Data security is not something that can be glossed over and ignored. more

Authorities Take Down the Mariposa Botnet

There are a number of sources talking about the takedown of the Mariposa botnet... Spanish authorities, working with researchers from Panda Labs, Defence Intelligence and a couple of other educational institutions, took down the Mariposa botnet (Mariposa is the Spanish word for "butterfly"). The Mariposa botnet is an absolutely enormous with around 12 million (!) nodes doing its bidding. It was involved in things like credit card phishing and identity fraud. more

Verisign Mitigates 300 Gbps DDoS Attack and Other Q2 2014 DDoS Trends

It has been another busy quarter for the team that works on our DDoS Protection Services here at Verisign. As detailed in the recent release of our Q2 2014 DDoS Trends Report, from April to June of this year, we not only saw a jump in frequency and size of attacks against our customers, we witnessed the largest DDoS attack we've ever observed and mitigated -- an attack over 300 Gbps against one of our Media and Entertainment customers. more

Government and Botnets

The US government is looking at telling ISPs how to deal with compromised customers and botnets. They're a bit late to the party, though. Most of the major commercial ISPs have been implementing significant botnet controls for many years now. more

When an IP Address Does Not Equal Individual Culpability - Breaking Glass Pictures v Does, DAZ 2013

Something bad happens online. I can tie that something-bad back to an IP address. Do I know who did the bad thing? According to the Federal District Court in Arizona, I don't. An IP address may identify the owner of an Internet access account; it does not identify who was online at that particular time and who may be responsible for the actions in question. In Breaking Glass Pictures v Does, DAZ 2013, Plaintiff brought a claim for copyright infringement, wants early discovery, but the court is refusing. more

DDoS Attacks Increased by 2000% in Past 3 Years, Asia Generating Over Half of Recent Attacks

In the past three years, Akamai has seen 2,000% increase in the number of DDoS attack incidents investigated on behalf of its customers. The latest State of the Internet report released today by Akamai also identifies top countries from which this observed attack traffic originates, as well as the top ports targeted by these attacks. more

ICANN and Iraq: Suffering Along

I thought of ICANN yesterday when reading about the devolution of the Iraqi Governing Council, which managed to unite for just a moment to approve a constitution with about the half-life of lutetium. ICANN and the IGC: two institutions put in charge of ill-behaved constituencies and stuck in chronic failure mode. Could anything be learned by examining them at arm's length? Indeed, different as they are, their histories contain several common elements... more