main

DDoSSecurityWAF

CDN Security is NOT Enough for Today

March 8, 2017 — by David Hobbs0

cdn-security-960x709.jpg

 

Today, many organizations are now realizing that DDoS defense is critical to maintaining an exceptional customer experience. Why? Because nothing diminishes load times or impacts the end users’ experience more than a cyber-attack, which is the silent killer of application performance.

As high-availability and high performance distributors of content to end-users, CDNs can serve as a lynchpin in the customer experience. Yet new vulnerabilities in CDN networks have left many wondering if the CDNs themselves are vulnerable to a wide variety of cyber-attacks, such as forward loop assaults.

So what types of attacks are CDNs vulnerable too? Here are top 5 cyber threats that threaten CDNs so you can safeguard against them.

Blind Spot #1: Dynamic Content Attacks

Attackers have learned that a significant blind spot in CDN services are the treatment of dynamic content requests. Since the dynamic content is not stored on CDN servers, all the requests for dynamic content are sent to the origin’s servers. Attackers are taking advantage of this behavior and they generate attack traffic that contains random parameters in the HTTP GET requests. CDN servers immediately redirect this attack traffic to the origin, expecting the origin’s server to handle the requests. But, in many cases, the origin’s servers do not have the capacity to handle all those attack requests and they fail to provide online services to legitimate users, creating a denial-of-service situation.

Many CDNs have the ability to limit the number of dynamic requests to the server under attack. This means that they cannot distinguish attackers from legitimate users and the rate limit will result in legitimate users being blocked.

Blind Spot #2: SSL-based attacks

SSL-based DDoS attacks target the secured online services of the victim. These attacks are easy to launch and difficult to mitigate, making them attackers’ favorites. In order to detect and mitigate DDoS SSL attacks, CDN servers must first decrypt the traffic using the customer’s SSL keys. If the customer is not willing to provide the SSL keys to its CDN provider, then the SSL attack traffic is redirected to the customer’s origin, leaving the customer vulnerable to SSL attacks. SSL attacks that hit the customer’s origin can easily take down the secured online service.

During DDoS attacks when WAF technologies are involved, CDN networks also have a significant weakness in terms of the number of SSL connections per second from a scalability capability, and serious latency issues can arise.

[You might also like: WAF and DDoS – Perfect Bedfellows: Every Business Owner Must Read.]

PCI and other security compliance issues are also a problem as sometimes this limits the data centers that are able to be used to service the customer, as not all CDN providers are PCI compliant across all datacenters. This can again increase latency and cause audit issues.

Blind Spot #3: Attacks on non-CDN services

CDN services are often offered only for HTTP/S and DNS applications. Other online services and applications in the customer’s data center such as VoIP, mail, FTP and proprietary protocols are not served by the CDN and therefore traffic to those applications is not routed through the CDN. In addition, many web-based applications are also not served by CDNs. Attackers are taking advantage of this blind spot and launch attacks on applications that are not routed through the CDN, hitting the customer origin with largescale attacks that threaten to saturate the Internet pipe of the customer. Once the Internet pipe is saturated, all the applications at the customer’s origin become unavailable to legitimate users, including the ones that are served by the CDN.

Blind Spot #4: Direct IP Attacks

Even applications that are serviced by a CDN can be attacked once the attackers launch a direct attack on the IP address of the web servers at the customer origin. These can be network based floods such as UDP floods or ICMP floods that will not be routed through CDN services, and will directly hit the servers of the customer at the origin. Such volumetric network attacks can saturate the internet pipe, resulting in taking down all the applications and the online services of the origin, including the ones that are served by the CDN. Often misconfiguration of “shielding” the data center can leave the applications directly vulnerable to attack.

Blind Spot #5: Web Application Attacks

CDN protection for web applications threats is limited and exposes the web applications of the customer to data leakage, data thefts and other threats that are common with web applications. Most CDN-based web application firewall capabilities are minimal, covering only a basic set of predefined signatures and rules. Many of the CDN-based WAFs do not learn HTTP parameters, do not create positive security rules and therefore it cannot protect from zero day attacks and known threats. For the companies that DO provide tuning for the web applications in their WAF, the cost is extremely high to get this level of protection.

In addition to the significant blind spots identified earlier, most CDN security services are not responsive enough, resulting in security configurations that take hours to manually deploy and to spread across all its network servers. The security services are using outdated technology such as rate limit that was proven to be inefficient during the last attack campaigns, and it lacks capabilities such as network behavioral analysis, challenge – response mechanisms and more.

 

DDoS_Handbook_glow

Download Radware’s DDoS Handbook to get expert advice, actionable tools and tips to help detect and stop DDoS attacks.

Download Now

DDoSSecurityWAF

WAF and DDoS – Perfect Bedfellows: Every Business Owner Must Read.

March 2, 2017 — by David Hobbs0

waf-ddos-960x640.jpg

Among the reasons to marry DDoS & WAF together, beyond a single pane of glass, beyond single vendor and quick technical response, and higher quality detection and mitigation – it makes sound business sense. Today, a good number of companies have developed the understanding that DDoS defense is critical to maintaining an exceptional customer experience (CX). Because of the extremely competitive nature of business these days, we are seeing more companies make the investments into digital transformation and customer experience. According to Gartner, customer experience is the new king.

Security

Can your SEO rankings be lowered by a DDoS Attack?

January 24, 2017 — by David Hobbs2

seo-ddos-attack-960x714.jpg

Last week, I was doing research in the DarkNet marketplaces to keep on top of the current trends in the threat landscape. One of the advertisements that struck me as typical was an advertisement for a DDoS botnet for rent. It wasn’t that there was a botnet for rent, as those are everywhere. It was the Listing Details that put together a value proposition for attacking somebody that caught my eye. It says:

“Another advantage of the DDOS attack that you probably don’t know is the loss of Google Organic Ranking. Google really don’t like unreachable URLs or slow website. As soon as they find a decrease of availability or speed, your target will be temporary removed from results and then it will lose his Google ranking. Two weeks after a four days DDOS attack, I have seen a website going from first page to third page.”

Security

The Current Surge of Bitcoin Prices

January 11, 2017 — by David Hobbs1

bitcoin-surge-960x640.jpg

It has long been known that if you want to participate in the Darknet marketplaces, you’ll need to exchange your money into Bitcoin.  Bitcoin was written by someone using the alias Satoshi Nakamoto in 2008 as an anonymous and decentralized currency. We’ve written in the past about how to buy Bitcoin. Today, for various reasons, we are seeing it become mainstream.

Ransom attacks on companies are becoming big business. Many businesses say they will not pay, but when attacked, find that they do.  But how do they pay?  Bitcoin. Just like having insurance policies, companies are now investing in keeping Bitcoin around for business continuity against DDoS attacks as well as Malware CryptoLocker and Data Extortion attacks.

Security

Nine Questions to Ask to Determine IoT Device Safety

December 14, 2016 — by David Hobbs0

internet-of-things-960x640.jpg

The holidays are almost upon us.  All around the globe, people are purchasing the latest and greatest gadgets as gifts. Consumers will be linking their new of Internet of Things (IoT) thermostats, doorbells, baby monitors, security cameras, home appliances and even GPS pet trackers to the internet in droves.

On the heels of the holiday season, the International Consumer Electronics Show will take place in Las Vegas, Nevada,  where device manufacturers reveal a whole new crop of IoT devices set to hit the market in 2017.  Amazon.com now has a team of “Smart Home” consultants who come to your house to help you wade through automation, Wi-Fi, ZigBee, Alexa and a sea of other “things” for your homes.

Attack Types & VectorsSecurity

Can a CDN Stop Cyber-Attacks?

February 26, 2015 — by David Hobbs5

In previous articles, we’ve reviewed content delivery networks (CDNs) from a variety of security perspectives – from how hackers have used them as weapons of DDoS to how bad actors can use free services to create astronomical billing issues.  CDNs are often used as a mask, to levy API abuse and web reflector attacks that plague the Internet via bots and scrapers.  Today, it is estimated that 65% of the traffic on the Internet is from such abuse.  If you were to reflect on that idea, would you think that a CDN can protect you?  That is the falsehood that is often believed.

Security

Is Your Home (Network) Haunted? The Threats of the Ghost Vulnerability and the IoT

February 5, 2015 — by David Hobbs0

Recent vulnerabilities have surfaced that have opened up interesting debates and spirited discussions regarding what I see as vulnerabilities in embedded Linux systems.  Devices that are considered part of the “Internet of Things” (IoT) have embedded Linux and this can make it fairly easy for hackers to compromise home networks.