Akamai Diversity
Home > Web Security

Recently in Web Security Category

FAQ: Vulnerability in the TLS 1.x protocol

The following advisory was written by CSIRT Manager Mike Kun:

We are aware of a newly-announced vulnerability found by Adam Langley and Brian Smith in some implementations of the TLS 1.x protocol that allows for a man-in-the-middle attack. This can result in insecure compromised transactions over TLS 1.x. For more details, read the original article.

Security Kahuna Podcast: Data Breach Lessons

In the latest episode of the Security Kahuna Podcast, Dave Lewis, Martin McKeay and I discuss the security breach at Sony, lawsuits between the banks and Target, and much more.

Rather than give the latest victims a lashing over mistakes that allowed the breach to happen, we focus on the lessons learned and how companies can better protect themselves going forward.

Microsoft's December 2014 Security Bulletin

Microsoft has released a preview of the security bulletin it plans to release Tuesday, Dec. 9, 2014. If the plan holds, the software giant will release seven bulletins -- three of them for critical vulnerabilities in Windows, Office and Internet Explorer. The full preview is below.

More Akamai perspective on patching and vulnerability management:

Because Akamai is trusted by thousands of online retailers, and in fact all of the 20 top global eCommerce sites, we see and analyze enormous amounts of attack data during events such as Black Friday. This year we tracked requests coming into dozens of online retailers over 24 hour periods for each of the 5 Fridays leading up to Black Friday. During that period we analyzed 4.2 billion HTTP requests directed at dynamic application pages (not including requests for media files, JavaScript or other static objects). For those 4.2b requests, we saw 574 million WAF rule triggers. We analyzed which rules were triggered more on Black Friday in order to answer a few questions. Our main goal was to figure out: Were the bad guys busy trying to wreak havoc or were they looking out for some good "deals" of their own?

My Turn on the "Security Influencer" Podcast

I recently sat down for a discussion with Contrast Security CTO Jeff Williams, host of the Security Influencer Podcast. We covered a lot of ground, including the most recent data breaches making news and the recent uptick in attacks against third-party web services.

DD4BC: PLXsert warns of Bitcoin extortion attempts

A Bitcoin extortion campaign is underway, launched by a group of bad actors calling themselves DD4BC. The group repeatedly tried to blackmail Bitcoin exchanges and gaming sites -- threatening victims with DDoS attacks in order to extort bitcoins. Akamai's Prolexic Security Engineering and Response Team (PLXsert) reports the following:

Boston OWASP meeting Dec. 3 at Akamai Headquarters

The Boston chapter of OWASP (Open Web Application Security Project) will have its next meeting at Akamai headquarters the evening of Wednesday, Dec. 3. Details are available on the OWASP Boston website, but here's a summary of the agenda:

Fresh Wave of DNS Record Hijacking Attacks Reported

Akamai has observed a fresh wave of DNS poisoning attacks, where web sites are hijacked and placed under the control of malicious actors.

It's a tactic Akamai has seen before, and there are ways for companies to defend themselves.

Anatomy of attacks
The Domain Name System (DNS) converts the text of a domain name (ie. akamai.com) to the server's IP address. Using DNS hijacking, a malicious user is able to update DNS records to resolve the domain to an IP that they own.

In most organizations, a limited number of people can make updates to their site's information with their DNS registrar. With most registries, updating records is as simple as logging in to a site with a username and password and changing the values of the DNS servers.

If an attacker is able to use social engineering or phishing to extract those account details, the attacker can then have the ability to redirect a domain to a different server. In some of the recent cases, this is exactly what happened.

Defensive measures
Companies should make employees aware of the threat and tactics used. Many times in these attacks, the username and password were successfully phished away from someone with the right credentials.

Companies can also lock their domains.

Domains can have locks at both the registry and registrar levels. The site owner can set and control registrar locks. These will prevent any other registrar from being able to successfully request a change to DNS for a domain. The locks that can be set at the registrar level by the site owner are:

  • clientDeleteProhibited
  • clientUpdateProhibited
  • clientTransferProhibited

The clientDeleteProhibited will prevent a registrar from deleting the domain records without the owner first unlocking the site. With the clientUpdateProhibited lock set, the registrar may not make updates to the domain and with the clientTransferProhibited set, the registrar may not allow the domain to be transferred to another registrar. The only exception to these is when the domain registration period has expired. These locks can be set and unset by the site owner and many registrars will allow these locks at no cost.

A second level of locks can also be put in place and these are set at the registry level. These are controlled by the registry and setting these can incur a cost to the domain owner. These locks are:

  • serverDeleteProhibited
  • serverUpdateProhibited
  • serverTransferProhibited

These locks operate similarly to the registrar locks in what they prevent, however they offer increased security in that they will require a phone call from the registry to the person who issued the request from the domain's registry.

The requester will need to give a predetermined pass phrase to the registrar to get the change made. These will lessen the chance of the registrar being able to make accidental or unwanted changes to the DNS records for the domain. Registry level locks offer a higher degree of security for the domain and may also incur a charge to implement.

8 Security Measures for IT Shops This Holiday Season

We've offered a lot of security advice for those shopping online this holiday season. But what about the IT practitioners responsible for securing sites those customers are using?

This post is for them.

Here are some words of wisdom I've picked up from security pros over the years. Some of the advice may seem obvious. But as I said yesterday, repetitive advice tends to be necessary in this hyper-connected, fast-paced world of ours. The advice is also not new. They are points I've been collecting for the last decade. But it's timeless advice, all the same.

Online Shopping Scams and How to Avoid Them

We recently shared five tips from Akamai Security Advocate Dave Lewis on how to avoid traps attackers set for online holiday shoppers. Today, we share articles from various publications to help you identify and avoid the most typical scams.

Tomorrow, I'll have a new post on things IT practitioners can do for their retail employers to harden systems against attack. The advice is important, because for every 100 failed online scams there are a few that succeed.

Some of the advice will seem repetitive. But if there's one thing we've learned, it's that good advice must be repeated often for more people to heed it.