Akamai Diversity

The Akamai Blog

Akamai SIRT Alerts

Akamai SIRT Alerts

March 9, 2017 3:35 PM

Vulnerability found in Apache Struts

On Monday, March 6th, the Apache team patched a vulnerability in Apache Struts2 framework. Apache Struts is an open-source web application framework for developing Java web applications. The vulnerability exists in the Jakarta Multipart parser, which can be tricked into executing attacker-provided OGNL code. The impacted versions are 2.3.5 through 2.3.31, and 2.5 through 2.5.10 of the Apache Struts framework. If you are currently running an affected version of the

Benjamin Brown

Benjamin Brown

March 2, 2017 1:17 PM

On Web Cache Deception Attacks

Summary On Monday, February 27, 2017, security researcher Omer Gil published a blog post laying out a data exfiltration method called a "Web Cache Deception Attack." The attack leverages web caching functionality to potentially expose sensitive information or allow for account takeover (ATO) attacks. Caching is often used to reduce load and time-to-delivery for a web server receiving requests for content, but this attack shows ways in which, given certain

Larry Cashdollar

Larry Cashdollar

February 24, 2017 1:45 PM

On memory overflow and responses

On February 23, 2017, Cloudflare released information on a bug that was disclosed by Google security researcher, Tavis Ormandy, in their content delivery network. The bug potentially exposed sensitive customer data to the Internet. Approximately 1 in every 3,300,000 HTTP requests may have contained potentially sensitive information. This information would normally be stored and cached by users and search engines as part of normal website sessions. This bug is similar

Meg Grady-Troia

Meg Grady-Troia

February 15, 2017 10:24 AM

Information Security Custom Audits for Akamai Custom ...

Over the last two years, Akamai has seen an increase in the number of customers who wish to run their own review of Akamai, either to satisfy their own information security or risk management program, or to gain the expertise to explain Akamai to their regulators and consumers. This increase is due to a confluence of factors, from Akamai's increased global sales presence, to heightened regulation of certain verticals by

Akamai

Akamai

February 7, 2017 8:55 AM

A WAF for the Other Half

The other half asks "May I please have some more (application security)." Another lifetime ago, way back in 2014, I wrote that "updating WAF rules is like flossing, everybody knows they should be doing it but it can be an easy step to forget and difficult to find the time to do it." At the time my conclusion was something along the lines of "so if you don't have

Ryan Barnett

Ryan Barnett

February 1, 2017 11:37 AM

WordPress Web API Vulnerability

On Tuesday, February 1, 2017, security vendor Sucuri disclosed a severe vulnerability in the WordPress REST API in versions prior to 4.7.2. The vulnerability allows for remote, unauthenticated and easily automated modification of blog post and page content by manipulating a parameter payload. Sucuri, Inc. notified Akamai of this vulnerability in advance of the public disclosure, which allowed the Threat Research team to internally confirm exploitability and to develop a

Meg Grady-Troia

Meg Grady-Troia

January 26, 2017 1:44 PM

Akamai's Global Content Distribution Network: Replac ...

Many customers ask Akamai about Disaster Recovery testing and Business Continuity planning as a part of their due diligence or risk management process. Customers expect to see a governance document maintained by a central authority, a list of systems with Recovery Point Objectives (RPO), Recovery Time Objectives (RTO), and a documented testing plan that is enacted quarterly or annually. Akamai reframes these questions to better match our approach to continuity

Or Katz

Or Katz

January 26, 2017 10:11 AM

Improving Credential Abuse Threat Mitigation

Have you ever tried to login to your favorite website and mistakenly typed the wrong user name and password once, or even twice? I bet you have. And what about submitting a third consecutive false attempt? In most cases, at that point a secure website will start questioning the integrity of your actions. From a defense point of view, websites should suspend and limit false login attempts to confirm authenticity

Larry Cashdollar

Larry Cashdollar

January 6, 2017 6:00 AM

JAR: What You Need To Know

On December 29th, the United States Computer Emergency Readiness Team (US-CERT), in coordination with the FBI, released a document outlining recent attacks against US interests that have been attributed to the Russian government. To be clear, Akamai does not comment on the attribution of attacks. Rather we would like to inform our customers of what a reasonable, informed course of action should be regarding this new information.