Re:Hackers target WHO as coronavirus cyberattacks spike
by DyslexicAtheist on Tuesday March 24, 2020 @07:36AM
(#22673983)
> It’s trivially easy to detect domain names intended to mislead: whó.net, or paypál.com
I've written a linux kernel filter that let's you do blocking for this exact case few weeks ago. no performance overhead since it uses the NFQUEUE/NFNETLINK kernel subsystems. I was pretty sure I'd be the only one ever using this but seems that hospitals or anyone who wants to block this on a gateway level would benefit. https://github.com/DyslexicAtheist/nfq/
I've written a linux kernel filter that let's you do blocking for this exact case few weeks ago. no performance overhead since it uses the NFQUEUE/NFNETLINK kernel subsystems. I was pretty sure I'd be the only one ever using this but seems that hospitals or anyone who wants to block this on a gateway level would benefit. https://github.com/DyslexicAtheist/nfq/