Max Resing

@resingm@infosec.exchange
200 Followers
350 Following
689 Posts

Passionate about networking protocols, the Internet, how to measure it and big data. Overall a curious mind and problem solver.

Interests & profession: #bigdata #dns #bgp #ddos #dataengineering #infosec #threatintel

Homepagehttps://maxresing.de
LinkedInhttps://linkedin.com/in/max-resing/

My colleague @jtk and I worked on a small piece on insights by #Netscout on the DNS root server system. Despite all of the nuisance traffic reaching the root servers, our #DDoS telemetry does not yield terribly much. This is not a bad thing though, and can be explained through the ubiquity of #anycast on the 13 root server instances.

#DNS #criticalinfrastructure #internet #resiliency

DNS Root Server Attacks | NETSCOUT

Executive SummaryThe internet is a system of systems. There is no central organizing committee that governs how it is constructed and operated.

NETSCOUT

@censys - Grand, the author is on Mastodon, too. @silas - tagging for visibility :)

Great article by the way!

@censys published a blog post on #NoName057(16) and their rotation through #DDoSia #C2 servers. I am a bit surprised that Censys did not join the party to track DDoSia until mid 2025, but I am glad they started to do so nonetheless. What I am missing is, what of the 3-layered architecture the authors are tracking.

#DDoS #malware #threatintel

Investigating the Infrastructure Behind DDoSia's Attacks

DDoSia is a participatory DDoS botnet targeting Ukraine and European entities, with a resilient, multi-layered infrastructure that adapts daily to disruption.

Censys

May I present to you a lexicographically sortable #UUID alternative? A simple and intuitive design is presented in ULID. It embeds a timestamp in the first 48 bits, followed by a random suffix of 80 bits.

#bigdata #databases

GitHub - ulid/spec: The canonical spec for ulid

The canonical spec for ulid. Contribute to ulid/spec development by creating an account on GitHub.

GitHub

"Kimwolf was so crazy that it really shot the entire Internet."

A #DDoS #botnet that launched 1.7 billion DDoS attacks in just 72 hours:

Kimwolf Botnet

#Infosec #botnet #android #malware #mirai

史上最疯:独家揭秘感染全球180万Android设备的巨型僵尸网络Kimwolf

背景介绍 2025年10月24日,安全社区的信任伙伴给我们提供了一个全新的僵尸网络样本,该样本最特别的地方是它的C2域名14emeliaterracewestroxburyma02132[.]su彼时在Cloudflare 域名流行度排名中位列第2,一周之后甚至超越Google,问鼎Cloudflare 域名流行度排名全球第一。毫无疑问这是一个超级大规模的僵尸网络,基于样本运行时输出的信息以及使用wolfssl库,我们将它命名为Kimwolf. Kimwolf 是一个使用 NDK 编译的僵尸网络,除具备典型的 DDoS 攻击能力外,还集成了代理转发、反向 Shell 和文件管理等功能。从整体架构来看,其功能设计并不复杂,但其中仍有一些值得关注的亮点:例如,该样本采用了简单而有效的栈异或(Stack XOR)操作对敏感数据进行加密;同时利用 DNS over TLS(DoT)协议封装 DNS 请求,以规避传统安全检测。此外,其 C2 身份认证采用基于椭圆曲线的数字签名保护机制,Bot 端会在验签通过后才接受通信指令。近期更引入EtherHiding技术以区块链域名对抗处置,

奇安信 X 实验室

Third tool announced by #Astral. This time it's a type checker and language server: ty.

This is it. I will now integrate uv, ruff and ty in my workflow. These folks produce such high quality #software. It's amazing!

#Python #ruff #uv #ty #foss #opensource

ty: An extremely fast Python type checker and language server

ty is an extremely fast Python type checker and language server, written in Rust, and designed as an alternative to mypy, Pyright, and Pylance.

Wow. I just had a popup on #Claude in which it allowed me to opt-in on storing historical chats for context. I thought, for my enterprise account that cannot hurt. So, I opted in. That very moment, Claude started a new conversation with "Hi Claude, what were some highlights from our recent conversations?", and showed me context from previous conversations.

So what was it now? Did I just opt in, and everything before that should have not been stored? Or did my opt-in not matter at all, because the conversations are store no matter my decision? Man, I am really tired of these dishonest tricks.

#LLM #GenAI #GenerativeAI #privacy

Reaching out to anyone who configured their DNS transport protocol. If you intentionally configured your home router's or your devices DNS service, what did you pick, and why?

Please retoot for reach.

#DNS #Survey #AskMastodon #AskFedi #AskInfosec #DoT #DoH #DoQ #TLS #QUIC #TCP #UDP #HTTPS

DNS-over-UDP
38.1%
DNS-over-TCP
4.8%
DoT
19%
DoH
33.3%
DoQ
4.8%
Poll ended at .

#Telegeography blogged about the expansion of #Starlink and how it conquers markets where conventional cabling fall short.

On the one hand, it's great to see increased connectivity in those areas, on the other hand, I am a bit concerned that a single legal entity has so much power about so many nations and their citizens.

#Starlink #Oceania #Micronesia #Pacific #Internet #Connectivity #Satellite

Wide Open Space: How Starlink Conquered Oceania

Starlink has rapidly expanded in Oceana. Here's an overview of this satellite broadband provider's regional growth.

It appears the Constitutional Court of #Germany stopped widespread surveillance through monitoring #DNS requests. Read more here.

I saw the necessity of #DoT, but I have to admit, I never convinced myself to go that router, other than just small test-runs. Maybe, I should setup DNS over #TLS over the Christmas break.

#encryption #cryptography #privacy #surveillance #karlsruhe #verfassungsgericht

Complaint: Karlsruhe temporarily halts controversial DNS surveillance

The Constitutional Court has suspended a district court's order to monitor DNS requests for a specific domain after a complaint from the provider.

heise online