Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Akamai. Show all posts
TSG Cyber Safety Alerts
Akamai API security Cyber Security Cyberattacks CyberCrime CyberThreat TSG Cyber Safety Alerts

Akamai Expands into API Security with $450 Million Noname Deal

 


It was founded in 2020 and is currently one of the top API security vendors in the world. After emerging from stealth in a year, Noname has reached unicorn status, as of 2021. As a result of the $220 million funding raised, Noname will be able to expand Akamai's existing API Security offering to satisfy customer demand and market demands. 

In addition to scaling up Akamai's sales and marketing resources, the acquisition will also enable Akamai to expand its existing API Security solution. Upon acquiring Akamai, the company will provide a comprehensive API security suite including shadow API detection and vulnerability and attack detection. Akamai powers and protects life online through its platform. 

Millions of people live, work, and play on Akamai's digital experiences every day, and leading companies around the world choose Akamai to help build, deliver, and secure them. A massively distributed edge and cloud platform from Akamai, Akamai Connected Cloud puts users closer to applications and experiences and keeps threats at bay. 

The Akamai acquisition will enable Akamai to provide customers with an API security suite that will enable them to find and detect “shadow” APIs as well as vulnerabilities and attacks better. In addition to providing customers with an enhanced deployment choice, Akamai's enhanced offering is expected to include a portfolio of unparalleled technology integrations in the industry. 

In addition to integrating Noname into Akamai's Application and API platform soon after the acquisition is complete, Akamai also plans to make Noname available to Akamai's customers as soon as possible. Among the many announcements that Akamai Technologies Inc., a provider of content delivery networks and cloud services, made today was Akamai's announcement that it would acquire Israeli application programming security company Noname Security for approximately $450 million. 

The two companies were reported to be in talks about a deal in February. According to a recent report published last month, talks between the two companies were in the advanced stages, with a $500 million acquisition price possible. Noname Security was founded in 2020, and its security platform provides enterprises with a comprehensive way of observing and safeguarding all kinds of application programming interfaces, regardless of whether they are managed or unmanaged. 

In a bid to “eliminate API blind spots,” this company’s platform was designed to protect enterprises from data leakage, authorization issues, abuse, misuse, and corruption of data. It has raised approximately $220 million to date at Noname Security, and when it raised a $135 million Series C round in December 2021, the startup was valued at $1 billion. 

In other words, the current deal represents a significant disappointment to the company's investors, especially the ones who came in at later stages, like Georgian and Lightspeed, as the deal represents a significant disappointment to most of them. The Syndicate Group (TSG), Insight Partners, Cyberstarts, Next47, and Forgepoint are also among the other investors. This deal underscores the fact that the cybersecurity market is continuing to consolidate as more companies seek to develop their products. 

There have been several cybersecurity startups that have emerged over the last few years, and the number continues to grow. It has been found that many of these companies struggle to scale, raise money or sell their products to customers who are looking to purchase a single point of contact to manage multiple security needs, which is why bigger players are buying the smaller and more promising of these smaller companies. 

In some cases, these discounts may not be as steep as you might think. The last private fundraise of Noname was valued at $1 billion in December 2021, so it is now valued at less than half that amount, making it one of the most expensive private companies in the world. Even though this discount may not be the worst, Wiz was negotiating to acquire Lacework Security for $168 million, a narrowly smaller value than its previous valuation of $8.3 billion, which was a blow to the company. 

There was, however, a problem during due diligence on that deal, which led to its failure. According to Akamai's press release, Noname will be integrated into their API Security business, which is expected to generate revenue of approximately $20 million for the company in fiscal year 2024 as a result of the acquisition. In the meantime, Oz Golan, co-founder and CEO of Noname, explained that the firm would be protected by Akamai when it acquired the firm, ensuring customers' apps were protected across various environments as well as platforms of various vendors.
Read more »
Vulnerabilities and Exploits
Akamai Bypass Methods DDOS Attacks Online Security RCE Flaw Vulnerabilities and Exploits

Researchers Find an Akamai WAF Access Point

The bypassing of Spring Boot-based Akamai web app firewalls (WAF) by a hacker could result in remote code execution (RCE).

The WAF from Akamai uses adaptive technologies to prevent known online security risks and was modified a few months ago in order to reduce the danger of Distributed Denial-of-Service (DDoS) attacks.

According to security researcher Peter M, the exploit employed Spring Expression Language (SpEL) injection, better known by the alias 'pmnh'. Usman Mansha and the analyst Peter H. claimed that Akamai has subsequently corrected the vulnerability, which was not given a CVE number.  

"This was the second RCE via SSTI we identified on this program, after the first one, the program added a WAF which we were able to overcome in a different portion of the application," GitHub explanation of the Akamai WAF RCE read. 

Access Point for WAF

The most straightforward approach to access the java.lang. Runtime class was through the SpEL reference $T(java.lang.Runtime), however, Akamai's software prevented this. 

Discovering a connection to a random class was the next step. Peter M., a technical writer, said that this would enable reflection-based or direct method invocation to access the desired method. 

Peter M. and Mansha constructed an arbitrary String using the java.lang and used a reflection mechanism to gain access to Class.forName.Accessible runtime value through Java.lang.

A second string was made to access the Runtime.getRuntime function and java.lang.Runtime, allowing for the creation of an effective RCE payload. The server recognized the final payload as a GET request because it was less than 3kb in size. 

The WAF was a difficult obstacle to get over, though. Finding an access point required more than 14 hours and 500 roughly designed tries, according to Peter M. In order to stop blatant copycats, the researcher chose not to provide the final payload in text format. 


Read more »
User Privacy
Akamai Command and Control(C2) Cyber Crime DDOS Attacks IP Address User Privacy

Akamai Sighted an Evolving DDoS attack in EU

 

The most recent DDoS attack record was set by Akamai in July, but it was surpassed on Monday, September 12, by a fresh attack. 

In a DDoS attack, cybercriminals flood servers with fictitious requests and traffic to block legitimate users from using their services.

According to the cybersecurity and cloud services provider Akamai, the recent attack looks to be the work of the same threat actor, indicating that the operators are now strengthening their swarm.

European businesses were the main targets of the current attack, according to Akamai. It peaked at 704.8 million packets per second, making it the second attack of this size against the same client in as few as three months and around 7% more powerful than the attack in July.

Prior to June 2022, this user primarily experienced attack traffic against the principal data center, as per Craig Sparling of Akamai. Six data center locations were hit by the threat actors' firepower in Europe and North America.

The day after it was discovered, the attack was stopped. This DDoS attack, while not the biggest ever, was notable because it was the biggest one on European organizations. The DDoS attack vector utilized by the attackers included UDP, along with ICMP, SYN, RESET floods, TCP anomaly, and PUSH flood.

The multidestination attack was immediately launched by the attackers' command and control system, increasing the number of active IPs per minute from 100 to 1,813 in just 60 seconds.

This expansion of the targeting area attempts to attack resources that aren't deemed essential and aren't effectively safeguarded, but whose absence will still be problematic for the company.

Published in July, the company saw 74 DDoS attacks, and 200 or more were added later. The business claimed that this campaign shows how hackers are always enhancing their attack methods to avoid detection. 

However, because the particular organization had safeguarded all 12 of its data centers in response to the July incident, 99.8% of the malicious traffic was already pre-mitigated.

The security company Akamai concluded, that having a solid DDoS mitigation platform and plan in place is essential for protecting your company from disruption and downtime.





Read more »
SSH
Akamai Cloud based services Container Security Crypto Mining Cyber Security DDOS Vulnerability Honeypot Intezer cybersecurity Kernel Kubernetes SSH

Safeguarding From Container Attacks Inside the Cloud


As an alternative to virtualization, containerization has become a key trend in software development. It entails encapsulating or packaging software code and all of its dependencies so it may execute consistently and uniformly across any infrastructure. Containers are self-contained units that represent whole software environments that may be transported. They include everything a program needs to run, including binaries, libraries, configuration data, and references. Docker and Amazon Elastic, as an illustration, are two of the extra well-known choices. 

Although many containers can run on the same infrastructure and use the same operating system kernel, they are isolated from such a layer and have a little interface with the actual hosting elements, for instance, a public cloud occasion. The ability to instantly spin up and down apps – for users, is one of the many advantages of running cloud-based containers. Admins may utilize orchestration to centrally manage containerized apps and services at scale, such as putting out automatic updates and isolating any malfunctioning containers.

Container adoption is at an all-time high, worldwide businesses of all sizes are eager to jump on board. According to a poll conducted by the Cloud Native Computing Foundation (CNCF), 83 percent of respondents plan to use Kubernetes in production in 2020, up from 78 percent the year before and just 58 percent in 2018. As adoption grows, cybercriminals' interest grows as well. According to a June Red Hat study, 94 percent of respondents have experienced a Kubernetes security problem in the last 12 months. 

Larry Cashdollar, an Akamai security researcher, recently set up a basic Docker container honeypot to test what type of attention it would get from the larger web's cybercriminals. The results were alarming: in just 24 hours, the honeypot was used for four different nefarious campaigns. Cashdollar had integrated SSH protocol for encryption and developed a “guessable” root password. It wouldn't stick out as an obvious honeypot on the web because it was running a typical cloud container configuration, he explained. It would instead appear to be a vulnerable cloud instance. The assaults had a variety of objectives: one campaign aimed to utilize the container as a proxy to access Twitch feeds or other services, another attempted a botnet infection, a third attempted crypto mining, and the fourth attempted a work-from-home hoax. 

"Profit is still the key motivator for cybercriminals attacking containers," as these cases demonstrate, according to Mark Nunnikhoven, a senior cloud strategist at Lacework. "CPU time and bandwidth can be rented to other criminals for buried services, or even used to directly mine cryptocurrencies. Data can be sold or ransomed at any time. In an environment where containers are frequently used, these reasons do not change." 

According to a recent Gartner study, client misconfigurations or mistakes would be the primary cause of more than 99 percent of cloud breaches by 2025. As per Trevor Morgan, product manager at comfort AG, most businesses, particularly smaller businesses, rely on default configuration options rather than more advanced and granular setup capabilities: "Simple errors or selecting default settings  that are far less safe than customized options." The problems with configuration typically go beyond the containers themselves. Last July, for example, misconfigured Argo Workflows servers were detected attacking Kubernetes clusters. 

Argo Workflows is an open-source, container-native workflow engine for coordinating parallel activities on Kubernetes to reduce processing time for compute-intensive tasks such as machine learning and large data processing. 

According to an examination by Intezer, malware operators were using publicly available dashboards which did not require authentication for outside users to drop crypto miners into the cloud. Far above misconfiguration, compromised images or layers are the next most serious threat to containers, according to Nunnikhoven. "Lacework Labs has witnessed multiple instances of cybercriminals infiltrating containers, either through malware implants or pre-installed crypto mining apps," he said. "When a group deploys the pictures, the attacker has access to the victim's resources."

According to Gal Singer, an Aqua Security researcher, the flaw (CVE-2020-15157) was discovered in the container image-pulling process. Adversaries may take advantage of this by creating dedicated container images which stole the host's token when they were pulled into a project.  Similarly, a denial-of-service vulnerability in one of Kubernetes' Go libraries (CVE-2021-20291) was discovered to be exploited by storing a malicious picture in a registry. When the image was taken from the registry by an unwary user, the DoS condition was generated.

The second source of concern is vulnerabilities, both known and unknown. In 2021, several container flaws were discovered, but "Azurescape" was likely the most alarming. Within Microsoft's multitenant container-as-a-service offering, Unit 42 researchers found a chain of exploits that might allow a hostile Azure user to infect other customers' cloud instances. 

Containerized environments can provide unique issues in terms of observability and security controls, according to Nunnikhoven, but a comprehensive security approach can help. Researchers recommended that users apply a laundry list of best practices to secure their Kubernetes assets: 

  • Avoid using default settings; use secure passwords.
  • To prevent attackers from impersonating the token owner, do not send privileged service account tokens to anyone other than the API server. 
  • Enable the feature "BoundServiceAccountTokenVolume": When a pod ends, its token becomes invalid, reducing the risk of token theft.
  • Examine orchestrators for least-privilege settings to verify that CI/CD movements are authenticated, logged, and monitored. 
  • Be comprehensive: Create a unified risk picture that includes both cloud-based applications and traditional IT infrastructure. 
  • Have data-analysis software in place, as well as an automatic runbook that can react to the findings.
Read more »
URL
Akamai Amazon Cryptocurrency Frauds Cyber Crime cybercriminals Ethereum Social Media URL

Amazon's Bogus Crypto Token Investment Scam Robs Bitcoin off Users.

 

Investors are being misled into turning over Bitcoin in a new cryptocurrency fraud (BTC). Scams involving cryptocurrency and digital tokens have become commonplace, posing a risk to potential buyers. 

Exit scams, rug pulls, and theft are still common, despite the fact regulators throughout the world are cracking down on fraud through tax laws, securities offering registration, tougher restrictions governing cryptocurrency advertisements, and a careful check on initial coin offers (ICOs). The popularity of cryptocurrencies and NFTs continues to rise, creating breeding soil for new frauds to emerge on a regular basis.

Utilizing Amazon's branding to promote a bogus scheme entitled "Amazon to produce its digital token," cyber-criminals are luring users to give away private credentials from the first step of the scam campaign. 

According to Akamai experts, the ongoing cyberattack attempts have profited from the cryptocurrency hype, including scammers using a range of phishing methods based on false rumors. "This particular fraud preyed on consumers' fear of missing out on a special offer to participate in a new cryptocurrency opportunity". Furthermore, in 2021, according to Chainalysis, fraudsters have received around $14 billion in deposits.

Visitors were asked to purchase for the pre-sale tokens with users cryptocurrencies, such as Bitcoin (BTC) or Ethereum (ETH). However, as the tokens aren't real, the funds ended up in the hands of criminals. 

Another enticement is a referral programme that allows the attackers to increase the scope of the token fraud with no further effort. In all, mobile devices were used by the majority of visitors to the phoney token landing pages (98 percent). The distribution of mobile operating systems, however, favors Android handsets (56 percent), with Apple iOS coming in second (42 percent). North America, South America, and Asia account for the vast majority of victims.

To avoid being a victim of fraud like this, users are advised to take the following precautions: 

  •  Be wary of bitcoin marketing and social media posts. 
  •  Before submitting information and making a purchase, double-check URLs and websites. 
  •  Don't be fooled by high-pressure techniques like "flash sales," "just a few left," or "buy now."
  •  Look for legitimate sources while researching what to buy. 
  •  When you see scam ads or postings, report them so they can be removed from social media. 
  •  Be alert, and therefore don't believe everything. 
It's essential to avoid chatting with random commentators or accepting unsolicited invitations from strangers, especially now when social media-based communication is at its most over-used in the pandemic.
Read more »
Zyxel
Akamai cybercriminals Log4Shell Microsoft Mirai botnet Ransomware Threat Remote Code Execution SolarWinds Vulnerabilities and Exploit Zyxel

Log4j Attack Target SolarWinds and ZyXEL

 

According to reports published by Microsoft and Akamai, cybercriminals are targeting SolarWinds devices with the Log4Shell vulnerability, and ZyXEL is known to use the Log4j library in their software.

Attacks have been reported on SolarWinds and ZyXEL devices using the log4j library, according to Microsoft and Akamai reports. CVE-2021-35247 has been assigned to the vulnerability, which has been paired with a zero-day in the SolarWinds Serv-U file-sharing service.

According to Microsoft's Threat Intelligence Center (MSTIC), the SolarWinds vulnerability, dubbed CVE-2021-35247, is a data validation hole that might allow attackers to compose a query based on some data and send it across the network without sanitizing. 

Jonathan Bar-Or, a Microsoft security researcher, is credited with identifying the flaw, which affects Serv-U versions 15.2.5 and earlier. In Serv-U version 15.3, SolarWinds patched the vulnerability. "A closer look helped discover the feed Serv-U data and it generates an LDAP query using the user unsanitized input!" he claimed. Not only might this be included in log4j attacks but it also is used for LDAP injection. 

SolarWinds claimed in its advisory, the Serv-U online log-in screen for LDAP authentication is  permitting symbols that are not appropriately sanitized and it had modified the input method "to do further validation and sanitization." The attacker cannot log in to Serv-U, according to a SolarWinds official, and the Microsoft researcher is referring to failed attempts because Serv-U doesn't use Log4J code. 

The unverified remote code execution (RCE) vulnerability in Log4j – identified as CVE-2021-44228 – has also been repurposed to infect and assist in the dissemination of malware used for the Mirai botnet by targeting Zyxel networking equipment, according to Akamai researchers. When researchers intended to access the Java payload class, the LDAP server in which the exploit was located was no longer active. It's claimed that Zyxel was particularly singled out since published an article claiming to have been hit by the log4j flaw. 

The scenario surrounding the Log4Shell breach has remained unchanged since last month, and threat actors looking to get access to corporate networks continue to target and exploit the vulnerability. Threat actors including ransomware gangs, nation-state cyber-espionage groups, crypto-mining gangs, initial access brokers, and DDoS botnets have all been reported to have exploited the vulnerability in the past. Although the Apache Software Foundation has issued patches for the Log4j library, threats against applications using it are likely to persist because not all of these apps have published a set of security updates, abandoning many systems vulnerable and creating a breeding soil for exploitation that will last for years.
Read more »
Technology
Akamai DNS Global Outage Technology

Global Outage Disrupts the Services of Major Websites

 

Several major websites faced outages on Thursday due to a glitch in Akamai Technologies Inc's (AKAM.O) systems, the second widespread outage linked to the cloud company in two months. Affected websites included DraftKings, Airbnb, FedEx, Delta, Barclays, and the PlayStation network used for online games. 

"We have implemented a fix for this issue, and based on current observations, the service is resuming normal operations," Akamai tweeted. 

The disruption was caused by a vulnerability in the domain name system (DNS) service, designed to keep websites, apps, and services running smoothly and securely, that was triggered during a software update and lasted up to an hour.

DNS services play a vital role in the functioning of the internet, but are known to have bugs and can be easily exploited by threat actors. Companies like Akamai have designed their own DNS services that are meant to solve some of these problems for their users. But when things go south or there’s an outage, it can cause a knock-on effect to all of the customer websites and services that rely on it.

Akamai said it was “actively investigating the issue,” but when reached a spokesperson, he would not say if its outage was the cause of the disruption to other sites and services that are currently offline. However, a spokesperson for ThousandEyes, an internet monitoring company bought by Cisco in 2020, attributed the outage to Akamai.

Major internet companies such as Zomato, Paytm, Disney+ Hotstar, Sony LIV were also affected due to issues with Akamai Technologies. Other affected services reported by Internet outage monitoring platform DownDetector included Banks such as Lloyds, TSB, and Halifax, gaming services including Steam, Call of Duty, and EA, and streaming services on Channel 4 and ITV.

In June, cloud computing provider Fastly had an interrupted service that took down social media, government, and news websites across the globe. In that case, it later emerged that settings change by one customer had inadvertently affected the entire infrastructure. Last year Cloudflare, which also offers networking services to companies across the globe, had a similar outage following a vulnerability that caused major sites to stop loading, including Shopify, Discord, and Politico.
Read more »
Subscribe to: Posts (Atom)