Archiv: sinkholes (faking / manipulating / blocking / taking over domains)


24.02.2021 - 11:35 [ Yahoo.com ]

SolarWinds, Microsoft, FireEye, CrowdStrike defend actions in major hack – U.S. Senate hearing

Lawmakers started the hearing by criticizing Amazon representatives, who they said were invited to testify and whose servers were used to launch the cyberattack, for declining to attend the hearing.

18.02.2021 - 15:29 [ SeekingAlpha.com ]

SolarWinds breach launched from within the United States

Neuberger notably said the attack, which compromised „9 federal agencies and about 100 private companies,“ was launched from inside the United States.
SolarWinds shares are down 1.4%. Two security names closely tied to the hack, FireEye (FEYE -3.2%) and CrowdStrike (CRWD -2.5%), are also in the red.

18.02.2021 - 15:28 [ CNN ]

Biden administration says investigation into SolarWinds hack is likely to take „several months“

The US government’s probe into the devastating SolarWinds breach is likely to take „several months“ at least, according to the top White House cybersecurity official, speaking to reporters Wednesday in the Biden administration’s first public assessment of the gravity of the suspected Russian spying campaign.

11.01.2021 - 10:04 [ Caitlin Johnstone. ]

Patriot Act 2, Censorship, And Other Notes From The Edge Of The Narrative Matrix

“We need to stop fascism so let’s give massive sweeping powers to an elite alliance of unelected authoritarians.”

“Well I’m a leftist and I haven’t been banned on social media.”

That’s because the left is politically impotent in our society. Unless this is just a hobby for you, at some point you should plan on the left becoming a threat to the oligarchs and warmongers. What do you think happens then?

Do you really think if the left actually becomes a threat to the status quo the Neera Tandens and Rachel Maddows aren’t going to suddenly discover a reason why you’re dangerous and need to be censored? The only way to be fine with censorship is to plan on never challenging power.

11.01.2021 - 09:51 [ Jesse Singal, author / Twitter ]

It’s sorta weird that Twitter does this mass banning of accounts, including, like, Red Scare, and the response from so many people is „Well they were all Nazis.“ Were they? What has Twitter revealed to you guys about the process that they are hiding from the rest of us?

11.01.2021 - 09:33 [ Glenn Greenwald / Twitter ]

It was a *Democratic-controlled* House sub-committee that just a few months ago issued a lengthy report concluding that FB, Amazon, Google & Apple are *monopolies*. That means competition is impossible. Now Dems are happy that it’s used for them:

I’ve been resisting the conclusion that this is Liberals‘ 9/11 because it at first seemed hyperbolic, even though they’re using the same weapons against their critics (if you question all the new powers they want, it means you love the Terrorists).

But this is Liberals‘ 9/11.

08.01.2021 - 23:32 [ inside-it.ch ]

Spoofing: Neue DNS-Angriffsmethode entdeckt

(13. November 2020)

Nachdem der Quellport de-randomisiert worden sei, sei es möglich gewesen, eine böswillige IP-Adresse einzuschleusen und so erfolgreich einen DNS-Cache-Poisoning-Angriff durchzuführen. Die Details haben die Forscher im Paper „DNS Cache Poisoning Attack Reloaded: Revolutions with Side Channels“ publiziert.

Weitere Experimente unter realistischen Serverkonfigurationen und Netzwerkbedingungen würden zudem zeigen, dass ihre grundlegende Methode leicht an das gesamte DNS-System angepasst werden könnte.

08.01.2021 - 23:04 [ .infosecurity-magazine.com ]

SAD Reality for DNS

The researchers determined that 35% of open resolvers are open to the attack, as well as four of six home routers made by well-known brands.

They also found that 12 of 14 popular public resolvers (now 11—Cloudflare says they’ve corrected their systems) are susceptible. Even a patched DNS server could be made vulnerable by an unpatched or misconfigured NAT gateway.

Their 19-page paper on the exploit includes lists of devices and services tested. They have since set up a SAD DNS website featuring a Q&A and a tool that anyone can use to determine whether their DNS is vulnerable.

The flaw is being tracked as CVE-2020-25705, and affects Linux 3.18 – 5.10, Windows Server 2019 version 1809 and newer, macOS 10.15 and newer, and FreeBSD 12.1.0 and newer. The researchers did not test earlier versions of the listed operating system.

20.12.2020 - 09:10 [ ZDF ]

Auch deutsche Firmen betroffen – Was über den US-Hackerangriff bekannt ist

Nach einem schweren Hackerangriff auf Behörden und Institutionen in den USA ist nach wie vor unklar, wer dahinter steckt.

19.12.2020 - 21:22 [ CNBC ]

Trump contradicts Pompeo, plays down alleged Russian role in cyberattack

Trump’s comments in the form of Twitter posts on Saturday went against comments his secretary of state made less than 24 hours earlier.
SolarWinds, the company at the center of the attack, has not yet blamed any one country.

19.12.2020 - 12:27 [ federalnewsnetwork.com ]

SolarWinds breach raises stakes for NDAA Trump still threatens to veto

Sen. Angus King (I-Maine) said the breach makes a clear case for the work of the Cyberspace Solarium Commission and the cyber provisions that made it into the annual defense policy bill passed by the House and Senate.

“This is the most important bill on cyber ever passed by Congress, and that’s why I’m really hoping that the president will either sign the bill or let it become law without a signature, because there is so much critically important material in the bill,” King said during an annual summit hosted by Defense One.

19.12.2020 - 12:24 [ Cyberspace Solarium Commission ]

Cyberspace Solarium Commission

The Cyberspace Solarium Commission (CSC) was established in the John S. McCain National Defense Authorization Act for Fiscal Year 2019 to „develop a consensus on a strategic approach to defending the United States in cyberspace against cyber attacks of significant consequences.“ The finished report was presented to the public on March 11, 2020.

Our Report

The Cyberspace Solarium Commission’s proposes a strategy of layered cyber deterrence. Our report consists of over 80 recommendations to implement the strategy. These recommendations are organized into 6 pillars:

– Reform the U.S. Government’s Structure and Organization for Cyberspace.

– Strengthen Norms and Non-Military Tools.

– Promote National Resilience.

Reshape the Cyber Ecosystem.

Operationalize Cybersecurity Collaboration with the Private Sector.

– Preserve and Employ the Military Instrument of National Power.

19.12.2020 - 11:52 [ ORF.at ]

Pompeo macht Moskau für Cyberangriff verantwortlich

Der Angriff weitet sich stetig aus. Nicht nur werden immer mehr Betroffene bekannt, darunter die US-Atombehörde und der Softwarehersteller Microsoft, es wurde zudem offenbar weitere Software für die laut US-Behörden sehr ausgefeilten Angriffe manipuliert.

19.12.2020 - 10:35 [ CNN ]

Congressional backers cite cybersecurity provisions as they push Trump to sign defense bill

The massive defense bill that President Donald Trump is threatening to veto contains provisions for increased cybersecurity, which has taken on significantly more importance in the wake of a massive cyberattack on federal agencies at the hands of suspected Russian hackers.

The National Defense Authorization Act includes pay raises for America’s soldiers, modernizations for equipment and provisions to require more scrutiny before troops are withdrawn from Germany or Afghanistan.

18.12.2020 - 21:38 [ geekwire.com ]

Microsoft unleashes ‘Death Star’ on SolarWinds hackers in extraordinary response to breach

In the end, this all reminds us how much power Microsoft has at its disposal. Between its control of the Windows operating system, its robust legal team, and its position in the industry, it has the power to change the world nearly overnight if it wants to. And when it chooses to train that power on an adversary, it really is the equivalent of the Death Star: able to completely destroy a planet in a single blast.

18.12.2020 - 21:36 [ domainnamewire.com ]

Domain name sinkholes and those funky domain registrations

(September 2018)

A sinkhole redirects or blocks traffic meant for a destination. They are used by the security community to stop botnet traffic, phishing and other bad activity.

There are many ways to create a sinkhole. An ISP can simply divert traffic from the IP address nameserver you see in Whois to another. A company (or the government) can also go through the courts to get control of a domain name and then change its nameservers.

18.12.2020 - 21:28 [ ZDNet.com ]

Microsoft and industry partners seize key domain used in SolarWinds hack

(15.12.2020)

According to analysis from security firm FireEye, the C&C domain would reply with a DNS response that contained a CNAME field with information on another domain from where the SUNBURST malware would obtain further instructions and additional payloads to execute on an infected company’s network.