Security Leftovers

posted by Roy Schestowitz on Jun 27, 2023

• Kevin Fenzi: A story of a Distributed Denial Of service

  We had a DDoS hit our DNS servers a few weeks ago, so I thought I would write up what happened for anyone interested.

  First, a bit of background: Why do we ( Fedora Infrastructure ) run DNS servers? Well, we run them to provide users resolution of our domains. It’s worth noting that we don’t provide recursive servers that will answer queries for any domain, but just authoritative servers for the domains we manage. Doing this allows us to quickly update things (which we depend on to take proxy servers in and out of rotation) as well as make sure we have dnssec working and other configuration. If we were setting this up these days, we might very well go with a trusted 3rd party provider, but we predate those really existing and for the most part it’s worked fine for us. We have a number of DNS servers, 2 of them in our main IAD2 datacenter and the rest spread out to various other places we have presence.

• Commission welcomes political agreement on new rules to boost cybersecurity in EU institutions, bodies, offices and agencies

  European Commission Press release Brussels, 26 Jun 2023 The Commission welcomes the political agreement reached between the European Parliament and the Council of the EU on the Regulation proposed by the Commission laying down measures for a high common level of cybersecurity at the institutions.

• Hackers steal personal information on thousands of pilot applicants at American and Southwest

  Hackers gained personal information about thousands of people who applied to become pilots at American and Southwest airlines. The airlines say there was a breach at a Texas company called Pilot Credentials, which the airlines used in their recruitment efforts. About 5,700 applicants to American and 3,000 at Southwest are affected. The airlines say hackers gained access in late April to names and birth dates, as well as Social Security, passport and driver and pilot license numbers of applicants for pilot and cadet jobs. The airlines notified those people last week.

• American Airlines, Southwest Airlines Impacted by Data Breach at Third-Party Provider

  The personal information of American Airlines and Southwest Airlines pilots was exposed in a data breach at a third-party services provider.

• Fortinet Patches Critical RCE Vulnerability in FortiNAC

  Fortinet releases patches for a critical FortiNAC vulnerability leading to remote code execution without authentication.

• Remotely Exploitable DoS Vulnerabilities Patched in BIND

  The latest BIND updates address three high-severity, remotely exploitable vulnerabilities leading to denial-of-service (DoS).

• Domain Name System is once again front and center for exploits and security policy

  Two recent events are once again bringing the internet's foundational Domain Name System into the news, and not in a good way. The first event involving the DNS last week was a warning from the Cybersecurity Infrastructure and Security Agency issued on Friday for version 9 of the Berkeley Internet Name Domain, or BIND.

• British Twitter Hacker Sentenced to Prison in US

  UK national Joseph James O’Connor was sentenced to five years in a US prison for hacking into Twitter accounts and stealing cryptocurrency.