Cybersecurity

The Challenge of DNS Security

When the domain name system (DNS) was first designed, security was an afterthought. Threats simply weren't a consideration at a time when merely carrying out a function - routing Internet users to websites - was the core objective. As the weaknesses of the protocol became evident, engineers began to apply a patchwork of fixes. After several decades, it is now apparent that this reactive approach to DNS security has caused some unintended consequences and challenges. more

X-Force Report: Corporations Becoming No. 1 Security Threat to Their Own Customers

With the alarming increase in cyberattacks, criminals are literally turning businesses against their own customers in order to steal consumer's personal data, warns the latest annual X-Force Trend and Risk report from IBM. "The security industry puts a lot of effort into the technical evaluation of security threats, examining, sometimes at great length, the potential threat that each issue might present to corporations and consumers. Criminal attackers out for profit, however, have considerations that the security industry does not always take into account, such as monetization cost and overall profitability." more

Colloquium on Collisions: Expert Panelists to Select Papers, Award $50K First Prize

According to the Online Etymology Dictionary, the verb collide is derived from the Latin verb collidere, which means, literally, "to strike together": com- "together" + lædere "to strike, injure by striking." Combined instead with loquium, or "speaking," the com- prefix produces the Latin-derived noun colloquy: "a speaking together." So consider WPNC 14 - the upcoming namecollisions.net workshop - a colloquium on collisions: speaking together to keep name spaces from striking together. more

Gary Warner: We Are Well Past Time to Declare a Spam Crisis in China

In a blog post last week, Gary Warner, director of research in computer forensics at the University of Alabama's (UAB) computer and information sciences department, wrote that it is well past time for someone to declare a "Spam Crisis in China". The warning comes along with UAB's reports that most of the spam they receive has ties to China. "It is very normal that more than one-third of the domain names we see each day in spam messages come from China," Warner wrote. "When one also considers the many '.com' and '.ru' domain names which are also hosted in China, the problem is much worse. More than half of all spam either uses domain names registered in China, is sent from computers in China, or uses computer in China to host their web pages." more

Five Inconvenient Facts about the Migration to 5G Wireless

An unprecedented disinformation campaign purposefully distorts what consumers and governments understand about the upcoming fifth generation of wireless broadband technology. A variety of company executives and their sponsored advocates want us to believe that the United States already has lost the race to 5G global market supremacy and that it can regain it only with the assistance of a compliant government and a gullible public. more

Kaspersky Lab Software Too Deeply Embedded in US Gov Network, Impossible to Get Rid Off by October

The law set by U.S. Government for all agencies to fully remove the controversial Russian based Kaspersky Lab security software by October is proving a lot harder than anticipated. more

What Chinese DDoS Malware Looks Like

While at that same Virus Bulletin conference that I was talking about earlier in my other post, I also had the chance to check out a session on Chinese DDoS malware put on by some folks from Arbor Networks. As little insight as I have into Android malware, I know even less about Chinese DDoS malware. So what's Chinese DDoS malware like? What are its characteristics? more

How to Donate Safely to Charity

Please share this post. After a tragedy, many of us want to donate to funds and charities to show our support for a community. However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains over the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, if not all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims? more

DNSSEC Workshop Streaming Live from ICANN 55 in Marrakech on Wednesday, March 9, 2016

What is the current state of DNSSEC deployment around the world and also in Africa? How can you deploy DNSSEC at a massive scale? What is the state of using elliptic curve crypto algorithms in DNSSEC? What more can be done to accelerate DNSSEC deployment? Discussion of all those questions and much more can be found in the DNSSEC Workshop streaming live out of the ICANN 55 meeting in Marrakech, Morocco, on Wednesday, March 9, from 9:00 to 15:15 WET. more

Widespread Compromised Routers Discovered With Altered DNS Configurations

A widespread compromise of consumer-grade small office/home office (SOHO) routers has been discovered by threat intelligence group Team Cymru. According to the report, "attackers are altering the DNS configuration on these devices in order to redirect victims DNS requests and subsequently replace the intended answers with IP addresses and domains controlled by the attackers, effectively conducting a Man-in-the-Middle attack." more

Cyber Security and the White House, Part 2 - Cyberwarfare

This is a follow-up to my previous post on Cybersecurity and the White House. It illustrates an actual cyberwarfare attack against Estonia in 2007 and how it can be a legitimate national security issue. Estonia is one of the most wired countries in eastern Europe. In spite of its status of being a former Soviet republic, it relies on the internet for a substantial portion of everyday life -- communications, financial transactions, news, shopping and restaurant reservations all use the Internet. Indeed, in 2000, the Estonian government declared Internet access a basic human right... more

Latest Wave of Organized Phishing Attacks Beat Two-Factor Authentication

Researchers at Certfa Lab provide a review of the latest wave of organized phishing attacks by Iranian state-backed hackers which succeeded by compromising 2-factor authentication. more

Measuring the Cost of Cybercrime

Last week at Virus Bulletin in 2012, Tyler Moore of Southern Methodist University (SMU) gave a talk entitled "Measuring the cost of cyber crime." It was a study done in collaboration with multiple individuals in multiple countries. The study sought to answer this question - How much does cyber crime cost? Up until this point, nobody really knew. more

The Internet and the Legitimacy of Governments

In two recent debate events I participated in, on iFreedom and privacy in the online world, mistrust of government and government's intentions and motivations on and towards the Internet were abundantly present with more than just a few people in the audiences. The emotions were not new to me, no, it was the rationality that surprised and sometimes almost shocked me. Why? Well, should these sentiments get the support of the majority of people, it would undermine all legitimacy of a government to govern. Let's try and take a closer look. more

The Pros and Cons of BYOD (Bring Your Own Device)

At the Virus Bulletin conference this past September in Dallas, Righard Zwienenberg from ESET gave a presentation entitled BYOD. BYOD stands for Bring Your Own Device, but he reframed the acronym to "Bring Your Own Destruction", that is, he alluded to the security implications of bringing your own device. BYOD is the latest trend sweeping business and schools. more