I stumbled on this excellent technical explanation of a relatively old data exfil method, using DNS tunneling. Many of us who have been enthusiasts of subverting systems going back to the 1980s have probably read ways to use exploit DNS to access the internet on dial-up ISP’s without authenticating.
About Stephen Crim
Stephen is a security solutions architect for Aquila, focused on state and higher education. He partners with new and niche OEM's which displace accepted industry norms. Through open integrations and standards, Stephen helps customers build environments customized for their teams and budgets. Before Aquila, Stephen administered data networks at the Chicago O’Hare and Midway airports. More recently, he was a network and data center administrator for a regional university in Southern New Mexico.
Entries by Stephen Crim
When I talk about sensor-based products, what I’m specifically referring to is any product that sits outside of the traffic flow, and consumes network traffic either via a TAP/SPAN port, a packet broker or a switch with packet broker capabilities, or through manipulation of a switch’s forwarding plane via OpenFlow or other SDN technologies.
Armis Breaks Down Vulnerabilities in the Internet of Things IoT (Internet of Things) has been the buzzword in security for the last 18 months. There have been a number of high-visibility breaches that were orchestrated because of them (one involving a wifi-connected fish tank comes to mind) and there is a lot of information and […]
Checkpoint Research Details Flaw in Fortnite SSO The Checkpoint blog reveals a great breakdown of a flaw in the SSO infrastructure used by the game Fortnite. SSO and other federated authentication platforms can be a double-edged sword. Developing any authentication system is very hard, web-based authentication especially so. You have competing requirements for interoperability […]
This post is going to switch back and forth a few times between two issues that plague enterprises as they grow: user credential re-use and administrative password management. Frequently, the bad credential hygiene of a small enterprise will stick around well into their transition to a mid-level enterprise. Most of these bad habits don’t survive […]