Hello, welcome to the Friday, February 1st, 2019 edition of the Sancton Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm quoting from Jacksonville, Florida.

This month, I already talked a couple of times about how domain admin consoles at registrars, but also locally are again targeted and how, for example,

fishing is being used to get credentials of administrators to then modify these domains.

Now one best practice, of course, is to monitor your own domain for changes.

So you do get an alert if an unauthorized change has been made and you can quickly react to this.

Today, Xavier posted a diary with a couple of tools that should help you identify these changes early.

Now, one nice thing he sort of does here is that

he uses a number of tools that you may already have in your environment. For example,

Nagios, which is often used to monitor uptime and such on servers. It can be used to monitor

changes. So you could, for example, add some critical host names and check the IP address. Don't

forget, for example, name servers here. Don't just monitor your web server. That's probably

the easiest one to figure out if it gets modified about MX records and name servers. That's

probably the most critical thing to monitor here. But he also has a little shell script that you can use to, for example, check changes to the start of authority record,

which would include the serial number, and tie this into OSEC.

OSEC is often used to monitor, for example, files for changes and collect logs. So a real flexible tool. I've seen

in a lot of environments and really easy to sort of add a quick check to it in order to get

an alert whenever something goes wrong with your domain. All of these techniques, of course,

only work if you tie them in with your

change control. If you don't do this, then of course, you'll get lots of false positives and

you'll stop looking at these alerts. Also, if you're using DNS like for failover, if you're using

it for load balancing, then sometimes these records can change quite quickly. So again, if you're using it for load balancing and sometimes these records can

...