Information Security & Occasional Forays Into Adjacent Realms
via Juha Saarinen, writing at Australia's well-regarded ITNews, reports of security failures in the Treck TCP/IP library, comprimising a wide range of supply-chain related IoT infrastructure. A single ray of happy sunshine illuminating this mess is the apparent acknowledgement of the flawed bits, and issuance of patches for the lib under scrutiny. Today's unfortunate bad news/good news Must Read.
via Muks Hirani, Sarah Jones and Ben Read writing at FireEye's threat research blog, comes notification of world-wide-dns-at-scale hijacks. Pre-election first-pass, stakes-in-the-ground reconnaisance foundation building? Or simple larcency? You be the judge. H/T
"FireEye Intelligence identified access from Iranian IPs to machines used to intercept, record and forward network traffic. While geolocation of an IP address is a weak indicator, these IP addresses were previously observed during the response to an intrusion attributed to Iranian cyber espionage actors." - via Muks Hirani, Sarah Jones and Ben Read writing at FireEye's threat research blog
News, via Ars Technica's Dan Goodin, detailing another BGP SNAFU - with the end result being the re-route of legit traffic - and this time - it's Googles' (Nasdaq: GOOG) bits-in-question. Included in the particularly bad-news-for-the-interwebs, is the belief that this redirect was not malicious - this, of course, remains to be proven. Stay Tuned.