The Big Attacks are Back…Not That They Ever Stopped

As we've seen with some of the recent high profile internet attacks, like HBGary, RSA, Google, Comodo and others, no one is immune from being a target and the perpetrators are exceedingly organized, exceptionally skilled and extremely well-funded. Often, the culprits might be better trained than the IT staff deployed to thwart the attacks. The attacks are targeted, elaborate and aggressive, not to mention a bit creative. The attacks are multi-layered in that once one type of attack settles in, another can and will crop up. They are not simply looking to deface a website but they are attempting to steal valuable data. Customer data, intellectual property, state secrets, SSL certificates and other proprietary, highly sensitive information are the top targets. The malware and other penetration techniques are custom made, can adapt and can cover the tracks of those seeking the information. They may start at the network level with DNS, ICMP or SYN flood attacks, then move to the application with Layer 7 DoS, SQL injection, or Cross-site scripts and once compromised, go after the data. Often they try to leave 'back-doors' so they can come and go as they please before being detected.  And the targets are changing.  A couple years ago it was retail and financial, like Target and Heartland, that were getting attacked and while those industries are still coveted kills, security companies, sensitive corporate secrets, and the internet’s overall infrastructure seem to be especially savory these days.

Many organizations do a decent job of securing their infrastructure components but are challenged when it comes to securing their web applications, whether they are hosted in a cloud environment, in-house or both. Forester reported that in 2009, 79% of breached records were the result of web application attacks. An application breach can cost companies significant amounts of money and seriously damage brand reputation. The 2010 Symantec/Ponemon Data Breach Loss Report calculated that the average cost to a company was $214 per compromised record and $7.2 million over the entire organization. Other areas that an organization may have to address as part of the breach include compliance issues, legal actions, public scrutiny and loss of trust.

BIG-IP ASM provides the application protection you require to block the evolving threats no matter where your applications are deployed in today's dynamic environments. One such threat is the recent ‘Slow HTTP DOS attack,’ which allows attackers to launch a DDoS attack by first sending a POST request with valid ‘content-length’ information and then slowly sending the POST message body, which leaves the server connection open depleting resources and eventually crippling the server’s ability to accept new connections.  BIG-IP ASM, a high performance, ICSA certified web application firewall (WAF) can protect against this HTTP vulnerability out of the box with HF-1.  Most of our competitors have addressed it through signature updates, or not at all.  Signatures are great when they discover Slowloris, not so great when they encounter 5l0wl0ri5.32a.   

Today, IT faces a variety of changes that require control points that can adapt dynamically and secure applications and their content as its being delivered from a variety of locations to a mass of users. This is especially true for cloud computing deployments and infrastructures that span between the cloud and the organization's data center.  F5 has the solutions to make any application deployment endeavor swift, successful and secure.

ps

Resources:

• Researchers To Demonstrate New Attack That Exploits HTTP
• Mitigating Slow HTTP Post DDoS Attacks With iRules (From Nov 2010)
• Mitigating Slow HTTP Post DDoS Attacks With iRules – Follow-up
• Layer 7 DDoS - OWASP (pdf)
• Layer 4 vs Layer 7 DoS Attack
• Denial of Service Attacks Get more Sophisticated
• In 5 Minutes - BIG-IP ASM L7 DoS & Brute Force Protection
• Comodo admits 2 more resellers pwned in SSL cert hack
• McAfee's website full of security holes, researcher says

Technorati Tags: BIG-IP, F5, silva, Oracle, Oracle Database Firewall, ASM, WAF, web application firewall, security, application security, database security, infrastructure 2.0

Connect with Peter:	Connect with F5:

A is for Application, J is for Jacked

…Criminal-toasty Application Jacked, Data’s tasty stolen too, You’re Application’s Hacked.  Application’s Jacked, Application’s Jacked - hum hum the rest in your head, glad to plant a jingle in you, to sing out all day!

Almost every day now, there seems to be a report about some ‘important’ system getting breached or some credit cards/identities being stolen or insecure infrastructures getting exposed with schools, universities, municipalities, states and even entire countries being the latest victims.  The recent 7Safe UK Security Breach Investigations Report stated, “86% of all attacks, a weakness in a web interface was exploited” and in his blog last week, Jeremiah Grossman wrote about the discrepancy in security spending verses the types of attacks that occur.  He breaks down the numbers to show that most of the security spending goes to perimeter defense like firewalls and says, ‘Organizations spend their IT security dollars protecting themselves from yesterday’s attacks, at the network/infrastructure layer, while overlooking today’s real threats.’ 

This got me thinking – will we ever get ahead of the game?  Is it a question of habit?  Is it being uninformed or not understanding the true nature of the threats?  Is it just checking the compliance box and not really going after true protection?  Is it a budget, education, staffing or perception issue?  Are the crooks way smarter?  Are there too many areas to secure – applications, code, infrastructure, DNS, data, and any other piece that needs to be protected?  Are there just a whole mess of insecure systems on the internet just waiting to get jacked?  Or a combination of all these?  Probably depends on many, mixed factors depending on organization, personnel, region and what can be accomplished within whatever boundaries are placed on those who are tasked to implement a solution.  Many security professionals over the years focused on a particular discipline like network, database, application and so forth yet many of those same folks are now tasked with understanding and securing all areas of the organization.

Almost every second of our life, we make choices/decisions hopefully based on the best information we have at the time.  Maybe we ask for additional advice, if available, to make a more informed decision.  Sometimes emotions come into play when trying to come to a rational conclusion and we all know the head and the heart can pull you in opposite directions.  There’s a part of me that wants to scold those who are lazy with securing data.  (Incidentally, I did that last night at the Disney on Ice show – one of the vendors had a clipboard with a stack of credit card receipts sitting right in front of the register for people to use to sign their slips – I could have easily slipped that into my jacket while he wasn’t looking and disappeared into the crowd with a stack of signed CC receipts.  I informed him that his ‘ease of use’ was actually not so smart.  He pulled it and later, while the clipboard was still there, the receipts were absent.)  Then there’s the other side that feels the need to educate and help those who might not understand the ramifications of their actions – the softer side of psilva.

In our personal life, while we might ponder or struggle with the huge, life changing decisions like a job change or moving the family, and after careful consideration we usually make the right choice but it’s all the little miniscule, insignificant decisions we make throughout the day that defines our character.  When the basis for our decisions is coming from several different factors and the outcome can effect many swaths both across the organization and the public at large, that can make it a much more difficult endeavor, especially when it comes down to Infrastructure vs. Application, even though both should get attention.  We can yell, bang our head against the wall, plead and beg, but security is a though beast to tame for typical IT departments.  Even if they do declare Application Security is top priority, there may be many other factors holding them back.  We probably still have a way to go when it comes to prioritizing dollars based on actual attack stats until it hits close to home – by then, it’s too late.

ps

Technorati Tags: Pete Silva,F5,security,application security,network security, business, banks, banking, education, economy, technology

Don’t say a Word

………………………………………………….….oh, you’re waiting for me?  This will probably be a short post since there are not that many security terms that begin with the 17th letter of our alphabet.  However, keeping Quiet is a common theme in security.  As mentioned numerous times, locking passwords, logins, and other sensitive information in your mouth vault keeps them from leaking to others.  Social Engineering has always been about compromising that vault.  Recently there was a post by Roger Thompson, AVG’s Chief Research Officer, which actually suggested to Write Down your passwords, especially complex, hard to remember passwords.  While this practice has been frowned upon for many years – as in the ever popular post-it’s stuck to laptops – there is some sense in creating (and writing down) difficult passwords that are extremely hard to guess.  Just put that paper in a safe location.  Our own Alan Murphy offered some advice about passwords just a few months ago.

Keeping Quiet is also what most companies do when they discover a breach, at least initially.  A survey from the 2008 RSA conference showed that 89% of security incidents go unreported.  More often it’s the insider breaches that say under the covers.  Some of that could be due to just being undetected but many companies don’t want the public exposure of a breach.  Laws have changed some of that and huge breaches, like the Heartland incident, must be reported so people can protect themselves.  Even the Heartland incident wasn’t detected for a couple months, and when it was, it didn’t get reported for yet another month.  Granted, sometimes law enforcement does ask victims not to say anything so evidence can be gathered and, as to not tip off the crooks.  In any event, keeping quiet about a breach happens more often than you think and it’s often due to the fear of a damaged reputation.  Of course there is an opposing view to the damage factor by Larry Walsh where he talks about the multitude of brands who have suffered major breaches and how consumers have either forgotten or forgiven.

While silence can be golden and rests are written into music for effect, when it comes to Data Breaches not saying a word can put your business in jeopardy and in the cross-hairs of the law.
ps

• #17 out of 26 Short Topics about Security
• previous stories: 16, 15, 14, 13.5, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1

Brought to you by the Letter L and the Number 7

Since I strayed a bit on #11 out of 26 Short Stories, I figured that this entry would be mostly a link-fest – about Layer 7.  A picture is worth a thousand words don’t cha know.  SANS just released a report that says ‘60% of All Attacks hit Web Applications,’ and other research indicates that 70% of all attacks target Layer 7. Today, I thought I would just share a list of common Layer 7 attacks to show the many ways applications can be breached.  List courtesy of Vikram Phatak.
HTTP

• Code Red, Nimda Worms & Mutations
• SQL Injection
• Directory Traversal Attacks
• MDAC Buffer Overflows
• Cross-Site Scripting Attacks
• Chunked Transfer Encoding Attacks

FTP

• FTP Bounce Attack
• FTP Port Injection Attacks
• Directory Traversal Attack
• TCP Segmentation Attack

Microsoft Networking

• Bugbear Worm
• Nimda Worm
• Liotan Worm
• Opaserv Worm

SSH

• Buffer Overflow Attack

SMTP

• SMTP Worm
• MIME Attacks
• SPAM Attack
• Command Verification Attack
• SMTP Error Denial-of-Service Attack
• Mailbox Denial-of-Service Attack (excessive email size)
• SMTP Mail Flooding
• Address Spoofing
• SMTP Buffer Overflow Attacks

DNS

• DNS Query Malformed Packet Attacks (pdf)
• DNS Answer Malformed Packet Attacks (pdf)
• DNS Query-Length Buffer Overflow
• DNS Query Buffer Overflow - Unknown Request/Response
• Man-in-the-Middle Attack

SNMP

• SNMP Flooding Attack
• Default Community Attacks
• Brute Force Attacks
• SNMP Put Attack

MS SQL

• Buffer Overflow attack
• SQL Slammer Worm

ps

• #12 out of 26 Short Topics about Security
• previous stories: 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1

Related links

• BIG-IP® Application Security Manager™