Apache Struts2 Remote Code Execution Vulnerability (S2-045)

March 9, 2017 | Adeline Zhang

Overview Apache Struts2 is prone to a remote code execution vulnerability (CNNVD-201703-152) in the Jakarta Multipart parser plug-in. When uploading a file with this plug-in, an attacker could change the value of the Content-Type header field of an HTTP request to trigger this vulnerability, causing remote code execution. For details, visit the following link: https://cwiki.apache.org/confluence/display/WW/S2-045?from=timeline&isappinstalled=0 […]

NSFOCUS named as Finalist in European IT and Software Excellence Awards 2017

March 9, 2017 | NSFOCUS

Intelligent Hybrid DDoS defence provider shortlisted for an impressive three awards London, UK- March 2017 – NSFOCUS, the intelligent hybrid DDoS defence provider, has been shortlisted as a finalist in the Public Sector & Utilities Solution of the Year, Security Vendor of the Year, and Security Solution of the Year categories for the European IT […]

Does a Dropbear DDoS in the Woods?

February 28, 2017 | Adeline Zhang

Author: Guy Rosefelt – Dir, PM Threat Intelligence & Web Security Recently, NSFOCUS has seen some interesting DDoS behavior.  Since Q4 of last year, there has been a rise in SSL/VPN and SSH based DDoS attacks.  Most people would not equate VPN or SSH as a viable mechanism for what is usually considered a volumetric […]

Enhanced Threat Awareness Proposition

February 24, 2017 | Adeline Zhang

Author: Cody Mercer, Senior Intelligence Threat Researcher Network threat attack vectors continually advance in diversity and complexity. Attacks supplied through advanced persistent threats (APT) now spread very quickly and on a larger scale. Various IOT devices and other assets to include mobile/hand-held devices, desktops, bare-metal networks, web applications, and social networks are all vulnerable to […]

Anatomy of An Attack – DNS Amplification

February 9, 2017 | Adeline Zhang

Author: Vann Abernethy, Field CTO Overview DNS amplification attacks ramp up the power of a botnet when targeting a victim.  The basic technique of a DNS amplification attack is to spoof the IP of the intended target and send a request for a large DNS zone file to any number of open recursive DNS servers.  The […]

Shamoon 2: Back On the Prowl

February 8, 2017 | Adeline Zhang

Authors: Stephen Gates, Chief Research Intelligence Analyst & Cody Mercer, Senior Intelligence Threat Researcher Overview From reports in late January 2017, the Shamoon malware is back. Shamoon wipes the disks of computers infected with the malware. Apparently a new Shamoon variant prompted Saudi Arabia telecoms authority to issue a warning on Monday, January 23, 2017 for […]

Understanding Ransomware: An Overview

February 8, 2017 | Adeline Zhang

Author: Stephen Gates, Chief Research Intelligence Analyst Ransomware: The Human Touch As a security professional, I often get asked about the latest threats. Most consumers don’t understand the difference between viruses, worms, Trojans, spyware, adware, scareware, malvertising, phishing, etc. Sometimes, even those of us in the field see it all as malware. Basically, it’s all malicious […]

JTB Breach Leaks 7.93 Million Customer Related Records

February 8, 2017 | Adeline Zhang

Executive Summary JTB Corp. (JTB), a well-known travel agency in Japan announced on June 14, 2016 that it had experienced a massive data leak upon an attack targeting its servers. Initial reports indicate that 7.93 million people using JTB to book trips may have had their personal booking data exposed. The leaked data contained sensitive […]

Reporting

Threat Intelligence 2017 Predictions Report

February 7, 2017 | Adeline Zhang

Authors: Stephen Gates, Chief Research Intelligence Analyst & Cody Mercer, Senior Intelligence Threat Researcher Executive Summary Looking back on 2016, there were a few key predictions that ended up becoming a reality. While many organizations have been reassuring themselves for years, saying: “Who would launch a DDoS attack against us?” – they ended up falling victim […]

2016 Q3 Report on DDoS Situation and Trends

February 7, 2017 | Adeline Zhang

Sources of Data NSFOCUS collects data from all of their DDoS Protection Solutions deployed worldwide that are being managed by their managed service offering. The botnets that are used across the world can be tracked by NSFOCUS, and those details are used to formulate many of the attack trends shown in this report. NSFOCUS is […]

Search

Subscribe to the NSFOCUS Blog