How to Avoid the New DNS Hijacking Attacks

eWeek | April 22, 2019

DNS Hijacking has been around for a while. Initially it began as a way for the bad guys to take you to a fake website so that your credit card info could be stolen, or so that you could be loaded with malware. But that’s changed to the point where you might never know that your internet sessions have been hijacked, and that your credentials have been stolen, despite using safeguards such as SSL. In some cases, even VPN sessions may not be enough to protect you. What’s happening is that the threat actors are manipulating your organization’s DNS records so that your users will find themselves going to a site operated by the malicious parties, and from there, will be directed to the site they originally intended to visit. As the traffic passes through the bogus site, the threat actors harvest your user credentials from the traffic before passing it along. Because many organizations use SSL to protect their traffic, the bad guys will also steal your SSL certificates so that their site can masquerade as your legitimate destination. There have been two recent campaigns carrying out this sort of attack. The first, found in late 2018 was called DNSpionage, and resulted in warnings from the Department of Homeland Security.

Spotlight

The internet has evolved over the past quarter of a century in our cyber security timeline and discover how a proactive, defense in depth approach can help your organization.

Spotlight

The internet has evolved over the past quarter of a century in our cyber security timeline and discover how a proactive, defense in depth approach can help your organization.

Related News

SOFTWARE SECURITY

BlueVoyant Recognized as the 2022 Microsoft U.S. Security Partner of the Year Winner

BlueVoyant | July 05, 2022

BlueVoyant, a rock-solid cyber defense platform company converging internal and external security, today announced it has won the 2022 Microsoft Security U.S. (MSUS) Partner of the Year award. The Microsoft Partner of the Year Awards recognize Microsoft partners who have developed and delivered outstanding Microsoft-based applications, services, and devices during the past year. The MSUS Partner Awards were created to supplement Microsoft's Partner of the Year program, both of which recognize outstanding work by Microsoft partners. The MSUS awards highlight US-specific partner impact. "BlueVoyant and Microsoft both recognize that cybersecurity is a team sport. "BlueVoyant has developed enablement technologies and scalable services to help customers maximize their Microsoft Security investments — bringing together the very best of both companies to drive the outcomes our customers demand. We are honored that Microsoft named BlueVoyant its prestigious U.S. Security Partner of the Year, among other recent accolades. We look forward to continuing to work closely with Microsoft to deliver the very best in cybersecurity to our joint customers." Milan Patel, global head of managed security services (MSS) at BlueVoyant The MSUS Partner of the Year Award recognizes BlueVoyant's commitment and trust that stands behind the company's cloud-native and outcomes-based platform, BlueVoyant Elements™. The platform helps companies across a variety of industries improve their cyber defense posture. Elements not only continuously monitors for problems, but also takes action against any vulnerabilities, risks, or threats, usually in a matter of minutes. The platform is based on three key pillars that help give clients the advantage over attackers — technology, telemetry, and talent. BlueVoyant has more than 700 customers, and 650 employees across five continents, with a proven track record of sustained high growth. The U.S. Security Partner of the Year award is the latest in a long list of accolades BlueVoyant has won from Microsoft. In 2021, BlueVoyant was named a Microsoft Security 20/20 Partner Awards Winner for Top MDR (Managed Detection and Response) Team. BlueVoyant was a 2022 finalist in the Microsoft Security Excellence Awards for Security MSSP (Managed Security Service Provider) of the Year. In addition, the company is a finalist for the Microsoft Canada 2022 Impact Awards in two categories — Healthcare Impact Award and Security Impact Award. BlueVoyant was also named as one of Microsoft's top 150 managed security partners. In May, BlueVoyant announced that the company was a key design partner for Microsoft's three new security services, including Microsoft Security Experts for hunting, a proactive threat hunting expert service; Microsoft Security Experts for XDR, a new hunting service that extends beyond endpoint hunting; and Microsoft Enterprise Security Services for customers looking for more tailored, hands-on help with security posture management, modernization and proactive hunting. About BlueVoyant BlueVoyant converges internal and external cyber defense capabilities into an outcomes-based, cloud-native platform called BlueVoyant Elements™. Elements continuously monitors your network, endpoints, attack surface, and supply chain as well as the open, deep, and dark web for vulnerabilities, risks, and threats; and takes action to protect your business, leveraging both machine learning-driven automation and human-led expertise. Elements can be deployed as independent solutions or together as a full-spectrum cyber defense platform. BlueVoyant's approach to cyber defense revolves around three key pillars — technology, telemetry, and talent — that deliver rock-solid cyber defense capabilities to more than 700 customers across the globe.

Read More

PLATFORM SECURITY

Delinea Publishes Guide for Server Security

Delinea | June 01, 2022

Delinea, a leading supplier of PAM solutions for seamless security, released "Conversational Server Access Security" to assist enterprises safeguard hybrid infrastructure against assaults. The free eBook from Conversational Geek illustrates how to use Zero Trust to adhere with Least Privilege and decrease risk. Cybercriminals target Windows, UNIX, and Linux servers on-premise and in the cloud to exploit vulnerabilities. By attacking servers, fraudsters may access financials, IP, and more, opening the door to system-wide data theft, ransomware, and worse. Delinea's guide on server access security explains how stacking security measures directly on servers can check that privileged credentials have the proper rights at every access point. Implementing a Zero Trust cybersecurity approach based on the Principle of Least Privilege reinforces this by giving access to server resources only to confirmed identities with the necessary entitlements, when they need them, and for only the time required to perform the job. Then remove those rights so they cannot be exploited. "The concepts of Zero Trust and least privilege are not new, but many IT and security professionals are unclear about how to apply them in rapidly-changing, more complex hybrid environments. This new resource can help anyone get a better understanding of how to secure access to on-premises and cloud servers and take actionable steps to avoid becoming the next victim of cybercrime targeting modern infrastructure." Joseph Carson, Chief Security Scientist and Advisory CISO at Delinea The eBook's best practices assist cybersecurity professionals in implementing a server access security plan to: Find and remove standing privileges that allow users to connect to servers from anywhere and at any time. At each access control point, verify identities and permissions. Make certain that only authorized users may access or modify resources on each server. Allow users just-enough, just-in-time access and only provide elevated access when necessary. At the server-side, log and record behavior.

Read More

PLATFORM SECURITY

XM Cyber Acquires Cyber Observer

XM Cyber | June 28, 2022

XM Cyber, a hybrid cloud security provider, announced the acquisition of Cyber Observer, a pioneer in Continuous Controls Monitoring (CCM) and Cloud Security Posture Management (CSPM). This is XM Cyber's latest growth milestone in a year in which the organization has considerably increased its lead position in the cybersecurity market. Companies are changing faster than ever before, owing to growing regulation, competition, and consumer expectations. Traditional risk management techniques are no longer cost-effective and are incapable of providing the coverage or speed necessary in a dynamic digital environment. By incorporating XM Cyber's market-leading attack path management with Cyber Observer's continuous control monitoring, security teams will be able to see both their cyber exposures as well as how their existing security controls and identification and response tools can react to these threats at any given time, accurately representing the true risk to the business. The Cyber Observer platform will be incorporated into XM Cyber's, providing a unified, continuous picture of the vulnerabilities and exposures that put vital assets at risk, as well as the security control gaps that fail to prevent assaults. It will also automate compliance validation and reporting for important standards such as ISO, NIST, GDPR, SWIFT, and PCI. "Even as awareness of cybersecurity risk continues to grow, attackers are thriving and routinely exploiting attack paths that can be used to move laterally through an enterprise network. Our goal is to give security teams the ability to easily understand and correct their security posture on a continuous basis, including weaknesses, exposures and compensating security controls across the full internal and external attack surface covering on-prem, cloud and SaaS systems. This acquisition is not an isolated event, but just the latest step in our strategy to provide the most comprehensive and proactive security posture management platform on the market." Noam Erez, co-founder and CEO, XM Cyber Schwarz Group is the world's fourth largest retailer and a major player in cloud computing. With the establishment of a European cloud, the corporation has expanded fast in the digital area in recent years. Schwarz bought XM Cyber as its cyber branch in November 2021. Since then, XM Cyber has expanded its product offering, increased its worldwide staff, and enlarged its customer base. Schwarz's strong financial stability and wide digital vision are a driving force for development and innovation. "Cyber Observer's patented continuous control monitoring capabilities are a perfect complement to XM Cyber's award-winning hybrid cloud security platform. We are excited about this opportunity and look forward to working with the XM Cyber team to deliver the first end-to-end continuous cyber security posture management solution supporting both cloud and on-premises coverage," said Shimon Becker, co-founder and CEO, Cyber Observer.

Read More