Short answer: Only If You've Already Been Hacked Fascinating game of "telephone" over the past week which started out as some research on how hackers could embed images into DNS TXT records, and wound up proclaiming, "Newly published research shows that the domain name system—a fundamental part of the web—can be exploited to hide malicious code and prompt injection ... View Post
“Sitting Duck” DNS flaw is a Red Herring
NOTE: If you followed some other domain to get here, then that domain us a "Sitting Duck" as outlined below. Contrary to the original Krebs on Security article: the vulnerability was introduced by a lapse at the Domain Registrar and not at the DNS Provider. All is explained below - and if this is your domain, perhaps think about talking to Domainsure to re-assess ... View Post
Ledger users lose 1.1M XRP via homoglyph attack
Many crypto-currency holders use Ledger hardware wallets to store their bitcoin off the exchanges. This is actually the safer way to play it, except when you fall prey to a phishing campaign to lure you to a fake site to update your firmware that instead, drains your wallet. Unfortunately even when employing a hardware wallet, you still have be on your guard ... View Post
How Cybercriminals Profit by Tapping Your Email
A few days ago I came across the CBC story on how a Canadian man had been defrauded out of $800,000 when cybercriminals inserted themselves into a real estate deal and had the funds diverted to themselves: ... View Post
Microsoft hoses own DNS causing global service outage
Yet another example of how nobody, regardless of size, resources nor expertise, is immune from DNS outages. Last week several Microsoft systems experienced a global outage when the company made a configuration error whilst migrating some legacy, infrastructure domains, to their own Azure platform. The errors had second-order effects within the Azure ecosystem ... View Post
Why You Must Learn to Love DNSSEC
(This is a reprint of an article originally run on our parent company's blog in June 2018). It’s been nearly two months since the high profile BGP hijack attack against MyEtherwallet, where crypto thieves used BGP leaks to hijack MEW’s name servers, which were on Amazon’s Route53, and inserted their own fake name servers which directed victims to ... View Post