main

Attack Types & VectorsSecurity

My Network has High Cholesterol

June 22, 2017 — by Ben Zilberman0

network-high-cholesterol-960x601.jpg

5 out of 6 businesses struggle daily with low profile DDoS attacks that consume their bandwidth and resources and pose a burden, resulting in poor service level and customer experience

You know how when you get to a certain age, feeling ‘good’ is not good enough? Well it might be good for your everyday life – obviously, you don’t need to extract the most out of your brain and muscles for the day-to-day to-do’s, but there is no guarantee that there is nothing there that negatively impacts your performance, or may be silently growing.

Attack Types & VectorsSecurity

Eliminating Single Points of Failure, Part 1

June 21, 2017 — by Louis Scialabba0

ddos-primer-part-1-960x788.jpg

The Risk DDoS Attacks Pose to Enterprises

The Role of the Firewall

A Firewall is a necessary first step in protecting an enterprise network by establishing a barrier between a trusted, secure internal network and another outside untrusted network such as the Internet. Firewalls have evolved considerably over the years, with the advent of next-generation firewalls to add application-aware filtering and intrusion detection capabilities and help customers improve their first line of defense. However, DDoS attacks are one vector where Firewalls are commonly the point of failure. In fact, Radware’s own research shows that the firewall is the cause of downtime during DDoS attacks roughly one-third of the time. The reason for this is the stateful nature of these devices, required to keep track of open sessions and transactions on the network. Maintaining session state requires use of session tables as well as other CPU resources that are finite and also responsible for other security features. Therefore under attack, the session table can be exhausted causing the firewall to fail.

Attack Types & VectorsSecurity

SMB Vulnerabilities – WannaCry, Adylkuzz and SambaCry

June 15, 2017 — by Daniel Smith1

smb-vulnerabilities-960x638.jpg

Last month on Friday, May 12th a global incident related to a ransomware variant named WannaCry broke out, targeting computers around the world. Everything from personal computers to corporate and university networks were affected by this campaign. The campaign spread across networks leveraging a recently disclosed vulnerability in Microsoft SMB service. On March 14th 2017, Microsoft released MS17-010, a security update, that addressed and patched six CVEs. Five were remote code executions and the sixth was related to information disclosure.

Attack Types & VectorsSecurity

BrickerBot only attacks compromised devices

May 18, 2017 — by Pascal Geenens0

brickerbot-research-update-960x540.jpg

BrickerBot uses a network of globally distributed devices that are passively detecting exploit attempts from devices infected with IoT bots such as Mirai and Hajime. BrickerBot reacts to an exploit attempt by scanning the source of the exploit for a set number of ports, trying to secure the device (assumption based on Janit0r statements) and if not able to, ultimately attempting to brick the device using exactly 90 brick sequences over the telnet session.

As long as IoT devices stay clean from any of the known IoT bots, there is no reason to fear the BrickerBot. While Hajime might have the best of intentions and is trying to proactively protect IoT devices from known malicious bots, it inadvertently will trigger the wrath of BrickerBot.

Attack Types & VectorsSecurity

WannaCrypt

May 16, 2017 — by Daniel Smith0

wannacrypt-ransomware-960x640.jpg

Over the last few days, Radware’s Security Research Groups have been monitoring a global incident related to a ransomware variant named WannaCrypt, also known as WannaCry, WanaCrypt0r and wcry. On the morning of Friday May 12th, a ransomware campaign began targeting computers around the world. Once a computer was infected, a worm replicated itself across the network, targeting other computers as well. Worms use a computer network to propagate to other machines and infect them with the malicious payload.

Attack Types & VectorsSecurity

The offspring of two comic book giants bring us the Bot Squad! Super freaky!

May 9, 2017 — by Carl Herberger0

Radware_The_Bot_Squad-960x960.png

To state the obvious, two well-known comic book giants have lit the imaginations of generations of children. They brought to life the fantasy that humans could be ‘super’ or immortal, or somehow infallible.

Each in their own way combined fantastical combinations of humans with unreal, unbelievable and incredible skills.

In the category of vision enhancement alone, there are legions of characters who have developed themselves in a surreal way, for example, through X-Ray vision, or super-acute vision (something akin to a hawk). Other superheroes were gifted with night vision or even eyes that fired deadly laser beams. However, did you know that these characters dreamt up in comic books all have somewhat real world equivalents? Well, maybe not in people, but clearly in video surveillance systems of the future.

Attack Types & VectorsSecurity

Radware’s ERT Mitigated a Spoofed-IPs Attack of Several Hundred Gbps

May 4, 2017 — by Ben Zilberman0

attack-analysis-960x540.jpg

Background:

Starting on April 1st, one of the most popular gaming operators from a large Asia-Pacific (APAC) country has suffered DDoS attacks, rendering the application unreachable and many gamers frustrated. It was a massive spoofed-IPs attack against the user authentication ports. After several attempts to mitigate the attack, the customer turned to a local cloud provider – who is a Radware partner – for help. As one the largest providers in APAC they took a stab at fighting the attack off, and called Radware to the battlefield.

Attack Types & VectorsSecurity

Digital Transformation Requires a Security Rethink

May 3, 2017 — by Zeus Kerravala0

digital-transformation-security-960x649.jpg

Over the past few years digital transformation has become a hot topic with both business and IT leaders.  Organizations that embrace digitization and use the concepts to create new processes and products have the opportunity to become leaders in their industries.  Those that do not will struggle to survive and possibly go out of business or be acquired by stronger firms.

Attack Types & VectorsSecurity

From BrickerBot to Phlashing, Predictions for Next-Level IoT Attacks.

May 2, 2017 — by David Hobbs0

iot-predictions-960x394.jpg

When BrickerBot was discovered, it was the first time we’ve seen a botnet that would destroy an IoT device, making it unusable. We’ve had cameras in the lab for our research on the Mirai botnet, so one was volunteered to be the guinea pig. Watching our beloved research lab’s IP-enabled camera turn into a useless paperweight was somewhat bittersweet. We knew BrickerBot v1 aimed to destroy insecure IoT gear, and this was validation. We had to either take it apart and solder a serial connection to it to re-flash it, or just spend the $60 on a new one to continue our IoT botnet research.