Cybersecurity

The Top 3 Emerging Threats on the Internet

Last week at RSA, Bruce Schneier gave a talk on the top 3 emerging threats on the Internet. Whereas we in the security field usually talk about spam, malware and cyber crime, he talked about three meta-trends that all have the potential to be more dangerous than the cybercriminals. Here are my notes. more

Smart Phishing for Smartphones

A common security prediction for 2010 is the continued rise of malware and phishing attacks on mobile phones. The MarkMonitor Security Operations Center recently detected an interesting twist on this theme involving a popular smartphone and the latest smart technologies used by cybercriminals. In this case, instead of compromising a smartphone to steal its information, cybercriminals used phishing techniques to clone smartphones. more

Preventing ‘Techlash’ in 2018: Regulatory Threats

U.S. Chamber of Commerce President Thomas J. Donohue on January 10, 2018, warned that "techlash" is a threat to prosperity in 2018. What was he getting at? A "backlash against major tech companies is gaining strength -- both at home and abroad, and among consumers and governments alike." "Techlash" is a shorthand reference to a variety of impulses by government and others to shape markets, services, and products; protect local interests; and step in early to prevent potential harm to competition or consumers. more

ICC Cyber-Enabled Crimes and DNS Abuse: Accountability Questions for Infrastructure Operators

The ICC's new cyber policy reframes Internet infrastructure as crucial to prosecuting atrocities, prompting DNS operators and network providers to grapple with emerging obligations around evidence, neutrality, and cooperation in international justice. more

Shouting ‘Bug’ on a Crowded Internet…

In the last few weeks we've seen two very different approaches to the full disclosure of security flaws in large-scale computer systems. Problems in the domain name system have been kept quiet long enough for vendors to find and fix their software, while details of how to hack Transport for London's Oyster card will soon be available to anyone with a laptop computer and a desire to break the law. These two cases highlight a major problem facing the computing industry, one that goes back many years and is still far from being unresolved. Given that there are inevitably bugs, flaws and unexpected interactions in complex systems, how much information about them should be made public by researchers when the details could be helpful to criminals or malicious hackers? more

Microsoft Takes Legal Action Against North Korean Cybercrime Group, Takes Down 50 Domains

Microsoft has taken control of 50 domains used by a North Korean cybercrime group dubbed "Thallium" to steal information from users, including government employees, think tanks, university staff members, and those working on nuclear proliferation issues. more

DNS Abuse Definition: Attributes of Mitigation

A substantial amount of DNS community discussion on the topic of DNS Abuse is focused on defining what is or is not DNS Abuse. The definition adopted by ICANN contracted parties, as well as the DNS Abuse Institute, is straightforward: DNS Abuse is malware, botnets, pharming, phishing, and spam where it's a vehicle for the preceding harms. There is, of course, some fuzziness on the margins, where technical harms are also using content. more

Celebrating 167 Years of Public International Law for Cyber Security

On 30 September 1850 at Dresden, the first international treaty was issued among the first sovereign nations to internet their national electronic communication networks. It was known as the Dresden Convention, and culminated several weeks hammering out basic requirements and techniques to implement an internet spanning the Austro-German European continent at the time, and established a continuing "Union" of signatories to evolve the provisions of the treaty. more

Governments and Governance

A United Nations task force recently held a two-day workshop on the question of who governs the Internet. U.N. Secretary General Kofi Annan challenged those of us present to ensure that the Internet and the World Wide Web support "the cause of human development."
Following in the long-standing tradition of skepticism about governments in the Internet community, some in the technical community and the Internet's chattering classes view the concerns expressed by the United Nations and countries such as Brazil, India and others, as a threat to the operation of the Internet itself. This article was originally published at CNET News.Com on April 6, 2004. more

Equifax Breach Blamed on Open-Source Software Flaw

Equifax has blamed a flaw in the software running its online databases for the massive breach revealed last week that has allowed hackers to steal personal information of as many as 143 million customers. more

Conventional Thinking Won’t Work in New Era of ISIS & ‘Unprecedented’ Cyber & Non-Cyber Attacks

Conventional thinking or solutions will no longer work in the new era of ISIS and the 'Unprecedented' cyber and non-cyber attacks we live in today. Like it or not, everyone is impacted, and no one is immune. Whether you are an average citizen, a chairman or CEO of a multinational, or a government or academic institution leader, the questions to ponder are: Do you know what to do next? Do you know what the solution is? more

DNSSEC Baby Steps Reported at ICANN 41

The Internet is slowly beginning to adopt the new DNSSEC domain names standard, but significant challenges remain. That was the main takeaway from a four-hour workshop on the technology held during the recent ICANN 41 public meeting in Singapore, which heard from many domain registries, registrars and other infrastructure providers. more

Memo to John Markoff: There are No “Do Overs” in History

Think for a moment of the enduring legacy of African slavery in America. Think of the way it tainted this country's culture and politics; think of the bloody Civil War, the ghettos... What if we could roll back the clock and ensure that our society was "designed" so that slavery was never permitted and never happened? ... But what if I told you that my computer science lab was working on a "new Internet" that would solve all the terrible security and privacy problems of the existing one? Would you find this claim more credible than a proposed retroactive solution to the problem of slavery? more

Volunteer-Based Project Succeeds in Taking Down 100,000 Malware Distribution Sites Within 10 Months

In March of 2018, abuse.ch, a non-profit cybersecurity organization in Switzerland, launched a project called URLhaus to collect and share URLs identified to be distributing malware. more

Notes from NANOG 63

The following is a selected summary of the recent NANOG 63 meeting, held in early February, with some personal views and opinions thrown in! ...One view of the IETF's positioning is that as a technology standardisation venue, the immediate circle of engagement in IETF activities is the producers of equipment and applications, and the common objective is interoperability. more