Domain Hijacking - Problem and Protection. Webinar with Spamhaus, 29 April 2020
Domain hijacking is becoming increasingly prevalent in the ever-evolving threat landscape. Since the start of this year, Spamhaus has observed an average of 100 hijacked domains a day, at one single domain registrar. Matt Stith of Spamhaus shows us how Spamhaus detects hijacking, and explains how you can monitor your own domains for signs of hijacking.
Legitimate domains, with a positive reputation, are a highly sought after resource by bad actors, and it could be your domain they hijack. From DNS hijacking to sending bogus emails to gain access to an owner's registry account, innocent users are regularly being taken advantage of. The fall-out from a hijacked domain is significant, with a potentially long resolution period.
At the end of the presentation Matt shares some best practices for protecting your own domains, including these steps:
Use Passive DNS to monitor your domains:
Check domains, IPs, and Brands using Free Passive DNS from Spamhaus (https://www.securityzones.net/spamhau...)
What is Passive DNS? A beginner’s Guide (https://www.securityzones.net/wp-cont...)
Consider DNS Firewall Threat Feeds:
Add Spamhaus DNS RPZ feeds to BIND (and other resolvers) (contact [email protected])
Beginner’s Guide to DNS Firewall/RPZ (https://www.securityzones.net/wp-cont...)
DNS Firewall Factsheet (https://www.securityzones.net/wp-cont...)
Rackspace DNS Firewall Case Study (https://www.securityzones.net/wp-cont...)
The slides for this presentation are available at: https://www.isc.org/docs/DomainHijack....
You are welcome to post your questions about BIND 9 DNS on our helpful community mailing list at https://lists.isc.org/mailman/listinf.... The BIND Administrative Reference Manual is online at https://bind9.readthedocs.io/en/stable/. We also maintain a knowledgebase of handy technical articles at https://kb.isc.org.
Internet Systems Consortium maintains and publishes the BIND 9 DNS software under the open source MPL 2.0 license. ISC is a non-profit, operating to help support the Internet infrastructure and facilitate independent connection to and participation in the Internet. We support this work by offering users professional technical support contracts, including advance notification of security vulnerabilities before public disclosure.
---
Learn more at https://www.isc.org