HackDig : Dig high-quality web security articles for hackers

Is domain name abuse something companies should worry about?

Even though some organizations and companies may not realize it, their domain name is an important asset. Their web presence can even make or break companies. Therefor, “domain name abuse” is something that can ruin your reputation. Losing control There are several ways in which perpetrators can abuse your good name to make a profit for the
Publish At:2020-09-18 14:45 | Read:93 | Comments:0 | Tags:Business abuse cctld dns domain domain name hijacking regist

DNS security best practices: Preventing DNS hijacking, poisoning and redirection

The importance of DNSThe Domain Name System (DNS) is one of the fundamental protocols of the Internet. It provides a lookup service that converts domain names (like google.com) into IP addresses (like 192.168.0.0).While DNS has always been an important protocol, the growing use of cloud-based services has made it even more so. IP addresses of services
Publish At:2020-09-14 10:32 | Read:111 | Comments:0 | Tags:DNS security

Bypassing security products via DNS data exfiltration

Introduction Criminals are using different strategies to compromise computer networks, infrastructures and organizations. Cyber incidents have increased in number and complexity since the exploitation of public vulnerabilities towards the use of advanced tactics, techniques and procedures (TTP).Data encryption malware, such as ransomware, is a good met
Publish At:2020-08-03 10:15 | Read:232 | Comments:0 | Tags:DNS

Lock and Code S1Ep11: Locating concerns of Bluetooth and beacon technology with Chris Boyd

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Chris Boyd, lead malware intelligence analyst for Malwarebytes, about Bluetooth and beacon technology. Last month, cybersecurity experts warned the public about the data collection embedded in the Donald Trum
Publish At:2020-07-20 15:06 | Read:262 | Comments:0 | Tags:Podcast atlas of surveillance blackrock cisa confidential vm

Website misconfigurations and other errors to avoid

Website owners, listen up: There are lots of things you shouldn’t do with your site, and many more you should avoid with the domains you’re responsible for. Insider malice, bad luck, and the stars aligning in impossible ways can all give your online portfolio a bad hair day. However, if you want to tempt fate, you can bring on the mayhem with website misconf
Publish At:2020-07-15 11:33 | Read:229 | Comments:0 | Tags:How-tos bank banking blog CMS dns hijack redirect website

Microsoft fixes critical wormable RCE SigRed in Windows DNS servers

Microsoft’s Patch Tuesday security updates for July 2020 addressed a 17-year-old wormable vulnerability for hijacking Microsoft Windows Server dubbed SigRed Microsoft’s Patch Tuesday addressed a 17-year-old wormable vulnerability for hijacking Microsoft Windows Server tracked CVE-2020-1350 and dubbed SigRed. The issue received a severity ra
Publish At:2020-07-14 17:46 | Read:309 | Comments:0 | Tags:Breaking News Hacking DNS hacking news information security

Beware “secure DNS” scam targeting website owners and bloggers

byPaul DucklinIf you run a website or a blog, you probably use a cloud provider or a dedicated hosting company to manage your server and deliver the content to your readers, viewers and listeners.We certainly do – both Naked Security and our sister site Sophos News are hosted by WordPress VIP.That’s not a secret (nor is it meant to be), not least
Publish At:2020-06-29 11:39 | Read:294 | Comments:0 | Tags:Uncategorized DNS DNSSec phish Scam

DNS exfiltration case study

Lately, we came across a remote code execution in a Tomcat web service by utilizing Expression Language. The vulnerable POST body field expected a number. When sending ${1+2} instead, the web site included a Java error message about a failed conversion to java.lang.Long from java.lang.String with value "3". From that error message we learned a couple of thin
Publish At:2020-03-04 10:31 | Read:556 | Comments:0 | Tags:Breaking Building DNS Dora Exfiltration

Corp.com is up for sale – check your Active Directory settings!

byDanny BradburyAn old domain that has lain dormant for 26 years is going on sale – and the results could be catastrophic for enterprises with poorly configured Active Directory setups.Brian Krebs reports that Mike O’Connor, a domain prospector who registered corp.com in 1994, wants to sell the domain for $1.7 million as he simplifies his estate.
Publish At:2020-02-15 12:43 | Read:721 | Comments:0 | Tags:Microsoft Security threats Active Directory Corp.com DNS dom

[SANS ISC] My Little DoH Setup

I published the following diary on isc.sans.edu: “My Little DoH Setup“: “DoH”, this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in  HTTPS but it’s not the goal of this di
Publish At:2019-11-25 09:25 | Read:2839 | Comments:0 | Tags:SANS Internet Storm Center Security DNS DoH PiHole SANS

As Internet turns 50, more risks and possibilities emerge

This op-ed originally appeared in the San Francisco Chronicle on October 28, 2019. We occupy a richly-connected world. On the Internet, we collapse distance and shift time. But this Internet that delivers mail, connects us with friends, lets us work anywhere, and shop from the palm of the hand, is a mere 50 years old, slightly younger than Jennifer Anisto
Publish At:2019-11-11 23:20 | Read:853 | Comments:0 | Tags:Awareness arpanet dns domain domains history of the internet

Google’s Security Research Team Identifies and Fixes 7 Vulnerabilities in Dnsmasq

Google security experts disclosed seven distinct vulnerabilities in the Dnsmasq software package. Regardless of what you may think of Google as a company, it is difficult to criticize their prolific and in-depth security research. The latest example is their disclosure of seven distinct issues in the Dnsmasq software package. From the authors’ website,
Publish At:2017-10-03 09:45 | Read:3873 | Comments:0 | Tags:Breaking News Hacking DHCP DNS Dnsmasq Google

ShadowPad in corporate networks

 ShadowPad, part 2: Technical Details (PDF) In July 2017, during an investigation, suspicious DNS requests were identified in a partner’s network. The partner, which is a financial institution, discovered the requests originating on systems involved in the processing of financial transactions. Further investigation showed that the sour
Publish At:2017-08-15 14:15 | Read:4748 | Comments:0 | Tags:Featured Research Backdoor DNS Software supply-chain attack

DNS Attacks Could Cost Your Company $2 Million a Year

The DNS (Domain Name System) is the keystone of the proper functioning of the internet. Each time you access your email or your Facebook, you’re using it. So when a DNS server is under attack and inaccessible, every website that it supports also becomes unavailable. DNS attacks have already had a major impact in the functioning of companies, and it turns out
Publish At:2017-07-27 11:30 | Read:5588 | Comments:0 | Tags:Security b2b cybersecurity dns

A critical flaw allows hacking Linux machines with just a malicious DNS Response

A remote attacker can trigger the buffer overflow vulnerability to execute malicious code on affected Linux systems with just a malicious DNS response. Chris Coulson, Ubuntu developer at Canonical, has found a critical vulnerability Linux that can be exploited to remotely hack machines running the popular OS. The flaw, tracked as CVE-2017-9445, resides in th
Publish At:2017-06-29 10:25 | Read:3259 | Comments:0 | Tags:Breaking News Hacking DNS LINUX

Tools

Tag Cloud