So obvious but I’m checking my unused domains to make sure they have no nameservers configured
The root of this vulnerability occurs when a managed DNS provider allows someone to add a domain to their account without any verification of ownership of the domain name itself. This is actually an incredibly common flow and is used in cloud services such as AWS, Google Cloud, Rackspace and of course, Digital Ocean. The issue occurs when a domain name is used with one of these cloud services and the zone is later deleted without also changing the domain’s nameservers. This means that the domain is still fully set up for use in the cloud service but has no account with a zone file to control it. In many cloud providers this means that anyone can create a DNS zone for that domain and take full control over the domain. This allows an attacker to take full control over the domain to set up a website, issue SSL/TLS certificates, host email, etc. Worse yet, after combining the results from the various providers affected by this problem over 120,000 domains were vulnerable (likely many more).
The Orphaned Internet – Taking Over 120K Domains via Continue reading
95 percent of operators surveyed will create mini data centers.
A little bit of Apple culture couldn't hurt.
For some reason, I seem to be a bit of a question magnet. Not that I mind, of course, because… Well, you’ll discover why in just a moment. I was reminded of this, this week, when someone asked me—”how do you know so much about so many different things?” Before I answered them, Steve Hood published his first post on his journey to the CCNA. Buried in this post is something very important in relation to the question in hand—
This completely exposes one of my primary pathways to knowing a lot of stuff about a lot of stuff. If you don’t see it yet, here it is in plain language, one weird trick that will really make you smarter.
Make certain you are Continue reading
Team8 describes itself as a cyber security think tank.
The Infotrek podcast gets into cutovers, including how to prepare for them, and tackles recent news including a police request for recordings from an Amazon Echo.
The post Infotrek Episode 10: Cutovers appeared first on Packet Pushers.