Understanding and Managing Security Events
summary
Cloud DNS hijacks reroute five IP blocks hijacked so a payment gateway's DNS resolves to servers in Ukraine for up to TTL set to five hours, exposing card data; trackers find an attacker site in the Czech Republic with stolen pricing files. Sophisticated crawlers use rotating addresses — more than 500 IPs — and simulate browsers, detected only by behavioral bot detection tied to click patterns (repeated “Next”). Country-level outages include a two-hour block for exams (Syria) and June 11 routing via Russia (North Korea).
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:23DNS hijacking on financial sites
- 4:43Bot traffic on dentist site
- 7:51Data theft from airlines
- 9:35Government internet outages for exams
- 10:19Geopolitical routing changes in North Korea
- 11:46Solutions for security events
related talks
47mDNS On Fire
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
48mDNS ATT&CK 2020 - review of the most interesting techniques
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
32mDNS as Added Security Against Ransomware Attacks
26mMisuse of DNS, the Second Most Used Protocol