Vercel’s Post

It's hard to believe that people design DNS protocol extensions (and implementations of the same) that allow for arbitrarily large computational costs for processing a simple query. But here we are. Suicide by DDOS. The first DNS resolver had a countdown for every query processed to guard against this or code errors that might create infinite loops.

Creating trust out of thin air – one of the most pervasive challenges in today's world of zero trust! A solution proposed by our expert staff Peter Thomassen for one aspect of this problem has now been approved to become an official Internet standard (RFC number to follow). We're excited to see this protocol taking its final steps to standardization! 📄 What is this about? – When a domain name on the Internet announces its cryptographic identity for the first time, it's hard to tell whether it is legitimate or fake. How do you know for sure? The idea is to transfer trust from the new domain's DNS operator, who uses its own cryptographic identity to endorse the new domain. For details, check out the specification: https://lnkd.in/emT3mHnd 💬 #Get_in_touch with our expert Peter Thomassen to learn more about the technology and how to ensure your DNS is secure. #itsecurityisnotbinary #ietf #dnssec #security

Simply changing your HTTP User Agent is not enough, did you know about TLS/SSL fingerprinting? what about Sec-UA headers added by Chrome since version 89? read on! https://lnkd.in/evVG4s6g

Web Shells Gain Sophistication for Stealth, PersistenceA favorite post-exploitation tool continues to gain sophistication, with one recent example adding disguised log-in pages, credential stealing, and information gathering via services such as VirusTotal.

This is brilliant. And also super scary. Without proper monitoring you might not even spot that something is wrong for a very long time. Same (or maybe especially) goes for container based applications. https://lnkd.in/drH2yWpT

The Reporting API is an emerging web standard that provides a generic reporting mechanism for issues occurring on the browsers visiting your production website. The reports you receive detail issues such as security violations or soon-to-be-deprecated APIs, from users’ browsers from all over the world. Collecting reports is often as simple as specifying an endpoint URL in the HTTP header; the browser will automatically start forwarding reports covering the issues you are interested in to those endpoints. However, processing and analyzing these reports is not that simple. For example, you may receive a massive number of reports on your endpoint, and it is possible that not all of them will be helpful in identifying the underlying problem. In such circumstances, distilling and fixing issues can be quite a challenge. In this blog post, we'll share how the Google security team uses the Reporting API to detect potential issues and identify the actual problems causing them. We'll also introduce an open source solution, so you can easily replicate Google's approach to processing reports and acting on them.

Learn the best course of action for preventing Remote Code Execution through an exploitation of regreSSHion.https://https://lnkd.in/eZh4RScW

AI-driven threats are on the rise. How can you protect your business? 1. Implement security controls to detect and block AI-powered attacks. 2. Develop incident response plans. 3. Stay up to date on the latest AI-driven threats. #Cybersecurity #AI

Secure-by-design is clearly important to the federal government, and there is a strong possibility that it will become a regulatory requirement for the critical industries enforced through an Executive Order. The post Federal Push for Secure-by-Design: What It Means for Developers appeared first on SecurityWeek.

Federal Push for Secure-by-Design: What It Means for Developers: Secure-by-design is clearly important to the federal government, and there is a strong possibility that it will become a regulatory requirement for the critical industries enforced through an Executive Order. The post Federal Push for Secure-by-Design: What It Means for Developers appeared first on SecurityWeek.