The Akamai BlogSubscribe
Akamai Edge 2014: Shellshock and Heartbleed Resource ...
Akamai Edge attendees will hear the names of two security vulnerabilities a lot this week: Shellshock and Heartbleed. Both shook the security industry to the core this year, and Akamai security staff spent countless hours working to protect customers against these threats.Before Edge gets underway, here are some resources to get familiar with what we've done to address the threats.More on the Web Security Track at Akamai Edge 2014:Akamai Edge
Akamai Launches New Protection for Shellshock-Bash
Akamai has created custom rules to help protect customers from the Shellshock-Bash vulnerabilities. The official names of these vulnerabilities and the WAF rules to address them are as follows:
Shellshock CVE-2014-6277 and CVE-2014-6278 Details R ...
Yesterday, we released an article on Akamai's security site detailing all of the CVE advisories now in circulation for Shellshock, and how they relate to Akamai's mitigation strategies. At the time we published, details had not yet been released for two of the six advisories -- CVE-2014-6277 and CVE-2014-6278. Late yesterday, those details were finally released.
Shellshock Update
The Shellshock vulnerability, originally announced as one critical issue in bash that allowed an adversary to execute arbitrary code, has grown from one vulnerability to six in the last week. For background on Shellshock, we've collected an overview and list of the vulnerabilities; for some history on Akamai's initial responses, read our original blog post. Shellshock raised a lot of questions among our customers, peers, auditors, and prospects. This
Akamai Edge 2014: A Look at the Web Security Track ( ...
In two weeks, I'll be at the Akamai Edge customer conference. It's a terrific opportunity to meet face-to-face with a lot of our customers and get their feedback on what's working for them and what we can improve upon. A robust Web Security track of talks is planned, and I'll be blogging about it. The security track will run each day of Edge. Here's a partial list of what's planned:
Environment Bashing
[UPDATE: 9/25/2014 11:30AM] Akamai is aware that the fix to CVE-2014-6271 did not completely address the critical vulnerability in the Bourne Again Shell (bash). This deficiency is documented in CVE-2014-7169. The new vulnerability presents an unusually complex threat landscape as it is an industry-wide risk. Akamai systems and internal Akamai control systems have been or are being urgently patched or otherwise mitigated in prioritized order of criticality. Akamai has developed
PLXsert warns of Spike DDoS Toolkit
Akamai's Prolexic Security Engineering and Research Team (PLXsert) is tracking the spread of Spike, a new malware toolkit that poses a threat to embedded devices, as well as Linux and Windows systems. Several versions of Spike can communicate and execute commands to infected Windows, desktop Linux and ARM-based devices running the Linux operating system (OS), PLXsert said in an advisory Wednesday morning.
Good Recognition for Akamai's Real-Time Web Monitor
Analyst Daniel Humphries has written a review of several threat monitoring tools for the "Software Advice" website, including a positive assessment of Akamai's Real-Time Web Monitor. Ours was among five tools Humphries looked at in his report, "Spotlight: Threat Visualizations." The others were Kaspersky's Cyberthreat Real-Time Map, Digital Attack Map -- a joint project between Google and security vendor Arbor Networks -- the Deutsche Telekom Attack Meter, and Trend Micro's
Coming Soon: New Security Whiteboard Videos
Last year, we released a bunch of videos containing security whiteboard lessons on a variety of topics. This Thursday we shoot four new episodes. Below is a preview of each episode.To see previous security whiteboard videos, go here and here.