Akamai Diversity
Home > Bill Brenner

Recently by Bill Brenner

Trends in Security for the Commerce and Travel Industry

Late last year, Akamai CSIRT Director Michael Smith gave a presentation about security trends affecting eCommerce and the travel industry. Around the same time, I conducted a two-part podcast interview with him on those and other security challenges.

I finally got around to watching the video of his presentation, and think the big picture he presented is as true today as it was then. Have a look, and then a listen.

Podcasts:

Bill Brenner and Michael Smith discuss Akamai CSIRT
Bill Brenner interviews CSIRT Director Michael Smith. They discuss the role of CSIRT in researching threats and vulnerabilities, as well as keeping customers and the wider public informed of defensive measures they can take.

Bill Brenner and Michael Smith discuss Akamai CSIRT - Part 2
Bill Brenner continues his discussion with CSIRT Director Michael Smith. In this installment, Mike describes the process by which CSIRT delivers daily threat intelligence to our customers, along with the defensive measures needed to block attacks.

Microsoft Security Update for November 2014

Microsoft released its November 2014 Security Update Tuesday. Windows, Office, Server Software and the .NET Framework are among the items affected.

More Akamai perspective on patching and vulnerability management:

Attackers Use DNS Flooder Tool to Amplify DDoS Impact

Akamai's Prolexic Security Engineering and Research Team (PLXsert) issued an advisory this morning warning of a new technique bad actors are using to launch DNS amplification attacks.

Amplification attacks generate large response packets with relatively small requests. Attackers create large DNS TXT (text) records to increase amplification, magnifying the impact of a DDoS attack. Several campaigns observed since Oct. 4, 2014 contain fragments of text taken from press releases issued by the White House, according to the advisory, available here.

PLXsert suspects the DNS flooder tool continues to be used in these campaigns.

5 Security Tips For Online Holiday Shopping

In the run-up to Cyber Monday, we're looking at different online shopping trends and how Akamai plays a critical role in keeping things running. As part of that, we'll be focusing on typical security threats to be aware of this time of year and beyond.

Let's begin with some wise advice from my colleague, Akamai Security Advocate Dave Lewis. He originally came up with these last year, but it bears repeating each year. From here, we'll delve deeper into the scams online shoppers must worry about. More advice for keeping secure will follow from there.

And now for Dave's tips...

Akamai CSIRT Director Michael Smith and WhiteHat Security Threat Research Center Senior Manager Matt Johansen gave a demonstration of how the Million Browser Botnet operates, during last month's Edge conference.

Below is the full presentation.

Talk description:

Online advertising networks can be a web hacker's best friend. For mere pennies per thousand browser impressions, service providers allow you to broadly distribute arbitrary JavaScript. Most advertisers use this feature to show ads, track users, and get clicks, but hackers don't play by the same rules as the rest of us.

Absolutely nothing prevents them from spending as little as $10 to create a massive JavaScript-driven browser botnet instantly.

WhiteHat Threat Research Center Manager Matt Johansen and Akamai CSIRT Director Michael Smith show you how easily a bad actor can commandeer browsers to perform DDoS attacks, participate in email spam campaigns, crack hashes, and even help brute-force passwords using just a few lines of HTML5 and JavaScript.


MikeMatt.png

In April, Akamai determined its network was vulnerable to the Heartbleed bug. In late September, the company determined it was vulnerable to the Shellshock bug.

In this case study, Akamai Chief Security Architect Brian Sniffen walks through Akamai's response to both and provides insights into the lessons learned for improved security and incident response.


Screen Shot 2014-11-04 at 5.13.22 AM.png


Akamai Edge 2014: Evolution of TLS/SSL

Akamai Chief Security Architect Brian Sniffen reviews the evolution of TLS/SSL during a presentation at Akamai Edge 2014. Following the Heartbleed vulnerability, attention turned to TLS, the fundamental building block of Internet encryption and authentication. Sniffen reviewed the evolving TLS standard, including new ciphers, authentication mechanisms and asymmetric key changes.


sniffen.png

Akamai's Prolexic Security Engineering & Research Team (PLXsert) issued a new advisory Monday that provides a full analysis of the Poodle vulnerability, including actions companies can take to blunt the impact.

It's the latest in a series of postings Akamai has done to keep the public informed of its Poodle response. In addition to reviewing this new advisory, please refer to the following posts as well:

This is the latest in a string of severe vulnerabilities this year, including Shellshock and Heartbleed. A full list of resources for all of these incidents can be found here.

Akamai PLXsert's Q3 2014 State of the Internet Report

Today we've launched the first all-security edition of the State of the Internet report. State of the Internet also has its own website now, where readers can delve into Akamai's threat intelligence, threat advisories, data visualizations and more.

Highlights of the security edition for Q3 2014 include a four-fold year-over-year increase in DDoS attack size and volume; new attacks targeting hand-held devices and the proliferation of easy-to-use attack tools.

In the latest episode of the Akamai Security Podcast, I talk to CSIRT Manager Mike Kun about what he calls an "interesting new attack vector" where bad actors forgo direct attacks against websites in favor of targeting third-party services the site is using.

"Rather than go against a target directly, bad actors are looking at what other services that website is using," Kun explains. "A simple one is DNS. If the attacker can compromise the registrar a site is hosted with, they can easily change the IP address mapping and point that at some other site."

Those who go for such attacks include hactivist groups looking to deface sites, or someone looking to steal information or drop malware for myriad purposes.

Widget providers are among the targeted. Kun notes that the chat function now available on many e-commerce sites is usually supplied by third parties.

"Sites are linking to code from third-party sites instead of running local code," Kun says. "So if an attacker can compromise that widget, they can attack your site."