Author Archives: Enurrendy

DDoS attackers stick to their target even if they are unsuccessful

Link11 has released its DDoS report for Q1 2021 which revealed the number of DDoS attacks continued to grow. Between January and March, more than double the number of attacks than the same period in the previous year were recorded. This suggest the already alarming threat level from cybercrime, a pandemic that has been raging since Spring 2020 alongside the fight against COVID-19, has once again intensified. DDoS attackers stick to their target The number … More ? The post DDoS attackers stick to their target even if they are unsuccessful appeared first on Help Net Security .

View article:
DDoS attackers stick to their target even if they are unsuccessful

Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities

The recent Microsoft Exchange Server vulnerabilities might have initially been exploited by a government-backed APT group, but cybercriminals soon followed suit, using them to deliver ransomware and grow their botnet. One perpetrator of the latter activities is Prometei, a cross-platform (Windows, Linux), modular Monero-mining botnet that seems to have flown under the radar for years. The attackers’ modus operandi Cybereason incident responders have witnessed instances of the botnet enslaving endpoints of companies across the globe, … More ? The post Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities appeared first on Help Net Security .

Excerpt from:
Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities

DDoS attack activity: 10 million-plus attacks and 22% increase in attack frequency

Netscout announced findings from its bi-annual Threat Intelligence Report, punctuated by a record-setting 10,089,687 DDoS attacks observed during 2020. Cybercriminals exploited vulnerabilities exposed by massive internet usage shifts since many users were no longer protected by enterprise-grade security. Attackers paid particular attention to vital pandemic industries such as e-commerce, streaming services, online learning, and healthcare generating a 20% year-over-year increase in attack frequency over 2019 plus a 22% increase in the last six months of … More ? The post DDoS attack activity: 10 million-plus attacks and 22% increase in attack frequency appeared first on Help Net Security .

Week in review: PHP supply chain attack, common zero trust traps, hardening CI/CD pipelines

Here’s an overview of some of last week’s most interesting news and articles: Attackers tried to insert backdoor into PHP source code The PHP development team has averted an attempted supply chain compromise that could have opened a backdoor into many web servers. The growing threat to CI/CD pipelines By hardening CI/CD pipelines and addressing security early in the development process, developers can deliver software faster and more securely. DDoS attacks in 2021: What to … More ? The post Week in review: PHP supply chain attack, common zero trust traps, hardening CI/CD pipelines appeared first on Help Net Security .

Continued here:
Week in review: PHP supply chain attack, common zero trust traps, hardening CI/CD pipelines

DDoS attacks in 2021: What to expect?

We’re only three months into 2021, and Akamai has mitigated 3 out of the 6 largest DDoS attacks they have ever witnessed. Two of these hit the same company on the same day, and the attackers’ goal was extort money from the target. “Growing” DDoS attacks Hoping for a major Bitcoin payout, DDoS attackers continue to raise the bar when it comes to attack size, frequency, and target diversification. “In 2021 alone, we’ve already seen … More ? The post DDoS attacks in 2021: What to expect? appeared first on Help Net Security .

Continue Reading:
DDoS attacks in 2021: What to expect?

OpenSSL fixes severe DoS, certificate validation vulnerabilities

Today, the OpenSSL project has issued an advisory for two high-severity vulnerabilities CVE-2021-3449 and CVE-2021-3450 lurking in OpenSSL products. OpenSSL is a commonly used software library for building networking applications and servers that need to establish secure communications. These flaws include: CVE-2021-3449 : A Denial of Service (DoS) flaw due to NULL pointer dereferencing which only impacts OpenSSL server instances, not the clients. CVE-2021-3450 : An improper Certificate Authority (CA) certificate validation vulnerability which impacts both the server and client instances. DoS vulnerability fixed by a one-liner The DoS vulnerability (CVE-2021-3449) in OpenSSL TLS server can cause the server to crash if during the course of renegotiation the client sends a malicious ClientHello message. “If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack,” states the advisory. The vulnerability only impacts OpenSSL servers running versions between 1.1.1 and 1.1.1j (both inclusive) that have both TLSv1.2 and renegotiation enabled. However, because this is the default configuration on these OpenSSL server versions, many of the active servers could be potentially vulnerable. OpenSSL clients are not impacted. Fortunately, all it took to fix this DoS bug was a one-liner fix, which comprised setting the peer_sigalgslen to zero. One line fix for NULL pointer issue leading to DoS, CVE-2021-3449 Source: GitHub The vulnerability was discovered by engineers Peter Kästle and Samuel Sapalski of Nokia, who also offered the fix shown above. Non-CA certificates cannot issue certificates! The Certificate Authority (CA) certificate validation bypass vulnerability, CVE-2021-3450, has to do with the X509_V_FLAG_X509_STRICT flag. This flag is used by OpenSSL to disallow use of workarounds for broken certificates and strictly requires that certificates be verified against X509 rules. However, due to a regression bug, OpenSSL versions 1.1.1h and above (but excluding the fixed release 1.1.1k) are impacted by this vulnerability, as this flag is not set by default in these versions. “Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check.” “An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten,” states the advisory. In effect, this means OpenSSL instances fail to check that non-CA certificates must not be the issuers of other certificates, therefore opening up the possibilities for attackers to exploit this miss. On March 18th, 2021, Benjamin Kaduk from Akamai reported this flaw to the OpenSSL project. The vulnerability was discovered by Xiang Ding and others at Akamai, with a fix having been developed by Tomáš Mráz. Neither vulnerabilities impact OpenSSL 1.0.2. Both vulnerabilites are fixed in OpenSSL 1.1.1k and users are advised to upgrade to this version to protect their instances. As reported by BleepingComputer, DHS-CISA had urged system administrators in December 2020 to patch another OpenSSL DoS vulnerability. Users should therefore protect themselves from security flaws like these by applying timely updates. Source: https://www.bleepingcomputer.com/news/security/openssl-fixes-severe-dos-certificate-validation-vulnerabilities/

See the original post:
OpenSSL fixes severe DoS, certificate validation vulnerabilities

Noction Intelligent Routing Platform 3.11 features the remote-triggered blackholing capability

Noction announced the release of the Noction Intelligent Routing Platform 3.11. This version focuses on the new remote-triggered blackholing feature, which allows the redirection of traffic to a non-existent resource (a so-called black hole), or the blocking of the unwanted traffic in a provider’s network, thus preventing such traffic from entering the IRP user’s network. It can be specifically used to understand better and mitigate the effects of the Distributed Denial of Service (DDoS) attacks. … More ? The post Noction Intelligent Routing Platform 3.11 features the remote-triggered blackholing capability appeared first on Help Net Security .

Read the article:
Noction Intelligent Routing Platform 3.11 features the remote-triggered blackholing capability

5G network slicing vulnerability leaves enterprises exposed to cyberattacks

AdaptiveMobile Security today publicly disclosed details of a major security flaw in the architecture of 5G network slicing and virtualized network functions. The fundamental vulnerability has the potential to allow data access and denial of service attacks between different network slices on a mobile operator’s 5G network, leaving enterprise customers exposed to malicious cyberattack. The issue has the potential to cause significant security risks to enterprises using network slicing and undermine operators’ attempts to open … More ? The post 5G network slicing vulnerability leaves enterprises exposed to cyberattacks appeared first on Help Net Security .

View original post here:
5G network slicing vulnerability leaves enterprises exposed to cyberattacks

DDoS attacks surge as cybercriminals take advantage of the pandemic

DDoS attacks reached a record high during the pandemic as cybercriminals launched new and increasingly complex attacks, a Link11 report reveals. The analysis showed a boom in DDoS attacks that were closely linked to the pandemic. Key stats Boom in attacks: From February to September 2020, the number of DDoS attacks nearly doubled and was on average 98% higher than in the same period last year. It Is estimated that there were 50 million DDoS … More ? The post DDoS attacks surge as cybercriminals take advantage of the pandemic appeared first on Help Net Security .

View original post here:
DDoS attacks surge as cybercriminals take advantage of the pandemic

Now it is F5’s turn to reveal critical security bugs – and the Feds were quick to sound the alarm on these BIG-IP flaws

Remote code execution, denial of service, API abuse possible. Meanwhile, FBI pegs China for Exchange hacks Security and automation vendor F5 has warned of seven patch-ASAP-grade vulnerabilities in its Big-IP network security and traffic-grooming products, plus another 14 vulns worth fixing.…

More:
Now it is F5’s turn to reveal critical security bugs – and the Feds were quick to sound the alarm on these BIG-IP flaws