.png)
Hackers have an obvious predilection for Python-based attack tools, says Imperva.
“When examining the use of Python in attacks against sites we protect, the result was unsurprising – a large chunk, up to 77%, of the sites were attacked by a Python-based tool, and in over a third of the cases a Python-based tool was responsible for the majority of daily attacks. These levels, over time, show that Python-based tools are used for both breadth and depth scanning,” the company’s researchers pointed out.
Python’s popularity is rising
Python is easy to learn, install and deploy, and is slowly but surely becoming one of the most popular programming languages.
It is extensively used in the information security industry and is particularly helpful for exploit development (it’s versatile and requires minimal coding skills), so it shouldn’t come as a surprise that bad actors like it, too.
Also, given that many attack tools started as testing tools and are often freely available from repositories like GitHub, bad actors can easily take advantage of them.
“Roughly estimating, more than 20% of GitHub repositories that implement an attack tool / exploit PoC are written in Python. In virtually every security-related topic in GitHub, the majority of the repositories are written in Python, including tools such as w3af , Sqlmap, and even the infamous AutoSploit tool,” the researchers noted.
Urllib and Python Requests are the two most popular Python modules used for web attack.
The applications and frameworks most targeted with Python tools are Joomla, WordPress, Struts and Struts 2.
“The most popular HTTP parameter value we’ve seen used in attacks, responsible for around 30% of all different param values used, belongs to a backdoor upload attempt through a PHP Unserialize vulnerability in Joomla! using the JDatabaseDriverMysqli object. The backdoor uploaded payload is hosted on ICG-AuthExploiterBot,” they shared.
from Help Net Security https://ift.tt/2Is7RlO
from Naked Security https://ift.tt/2ycuJBh
California Governor Jerry Brown signed into law SB 822, the strongest and most comprehensive state-level net neutrality bill in the country.
The bill passed the state legislature with overwhelming and bipartisan support, and could unleash a wave of similar efforts in other states, with serious implications in the fight to restore net neutrality nationwide. The Department of Justice on Sunday night sued California over its new new neutrality law.
“This victory in California is a testament to the power of the free and open Internet to defend itself. And it’s a beacon of hope for Internet users everywhere who are fighting for the basic right to express themselves and access information without cable and phone companies controlling what they can see and do online.” said Evan Greer (pronouns: she/her), deputy director of Fight for the Future, the digital rights group that played a leading role in passing SB 822 and bringing national attention to the bill. “Despite their army of lobbyists and millions spent lining the pockets of legislators, these companies continue to lose ground in the face of overwhelming cross-partisan opposition to their greedy attacks on our Internet freedom. When all is said and done, Comcast, Verizon, and AT&T are going to wish they’d never picked a fight with Internet over net neutrality. Other states should follow California’s lead, and Congress should pass the joint resolution to reverse the FCC’s resoundingly unpopular repeal.”
SB 822 becoming law is a major victory for Internet activists who harnessed massive public outcry to pass the bill and a resounding defeat for big telecom companies like AT&T and Comcast, who spent millions to defeat the bill. SB 822 was nearly scuttled by fierce telecom lobbying, but prevailed after Fight for the Future brought the full force of the Internet down on California legislators, including crowdfunded billboards and a thousands of phone calls.
Californians will now be protected from giant ISPs like AT&T and Comcast, who will once again be barred from blocking, throttling and paid prioritization. Like the 2015 Open Internet Order that was repealed in 2017, the bill also bans ISPs from charging websites to load for the ISPs subscribers or using the point where data enters the ISPs network to evade net neutrality. Finally, the bill also makes sure that Californians are protected from mega-corporations like the newly minted AT&T-TimeWarner who want to push their content and services on subscribers, while harming all other speakers and companies on the internet.
SB 822 is widely regarded as the best state-level net neutrality bill in the country. That’s why AT&T and Verizon fought so hard, even managing to gut the bill in committee in June. But after howls of outrage online from the grassroots, the bill later passed with all the key protections Since California is the world’s fifth leading economy, SB 822 has implications for the entire nation. Its passage with bipartisan support is expected to bolster efforts in Congress to reverse the FCC’s repeal using the Congressional Review Act (CRA.)
Giant Internet service providers like AT&T and Comcast poured money into lobbying and misinformation campaigns to stop SB 822 and managed to gut it once in committee. They funded astroturf front groups, who targeted seniors with misleading robocalls, and ran Twitter ads generating tweets targeting California assembly members that look like they’re from real constituents. One of these groups, CALinnovates, which was paid $200,000 to run dark ads on Facebook and Twitter, even lies about its membership, claiming Uber is a partner when the company denies it.
from Help Net Security https://ift.tt/2xOe1sw
Help Net Security sat down with Jeremy Rowley, Executive Vice President of Product at DigiCert. He leads the company’s product development teams serving its emerging markets clients that require security solutions for the Internet of Things, U.S. federal healthcare exchange, advanced Wi-Fi and other innovative technology sectors.
The stable release of Google Chrome 70 is coming up this month. This means that sites with remaining Symantec certificates will be flagged as untrusted. What does this mean for end users, organizations, and the information security industry?
In 2017, Google and Mozilla deemed Symantec’s controls over their PKI insufficient to continued operation within the browser root store and put in place a plan for gradual distrust of Symantec roots. Other browsers followed suit. On Oct. 31, 2017, DigiCert completed its acquisition of Symantec Website Security and put in place a plan, approved by browsers, to issue new certificates for Symantec brands and replace those to be distrusted by reissuing them on our trusted roots. Google’s plans included three critical dates, and we are now in the final stage of Google’s plan with the release of Chrome 70. The dates were:
- December 2017 – One month after the DigiCert – Symantec deal closed, validation and issuance of new Symantec-brand certificates were transitioned to DigiCert’s PKI. No changes are required by the customers of either of the two companies except that all new issuance required revalidation of the customer information using a DigiCert verification process.
- March 2018 – Chrome 66 beta distrusted all certificates issued by Symantec prior to June 1, 2016.
- October 2018 – Chrome 70 stable will distrust all certificates issued from the Symantec PKI. When released, the stable version of Chrome will feature untrusted warnings for any certificates still using Symantec roots.
Visitor’s of a website that doesn’t migrate to DigiCert’s PKI prior to the required timelines will have a warning that their communication is not private. Fortunately, we’ve been taking extensive efforts to help provide a simple replacement process, and it’s working. As of mid-September, only between 1-2 percent of leading sites (Alexa 1 million base domains) had yet to get a replacement, and the replacements continue to accelerate. We are in a good place leading up to the Chrome 70 stable release currently scheduled for mid-October.
What advice would you give to those that are still deploying Symantec-issued certificates?
Our advice for any business still deploying a Symantec-issued certificate is to replace the certificate with a DigiCert certificate, for free, before users receive a warning in the browser. Anyone using a certificate issued from Symantec’s roots that includes any of its other brands, including Thawte, GeoTrust or RapidSSL, should replace the certificate now. DigiCert is offering to help customers make the transition with free replacements of Symantec-issued TLS certificates to extend trust through the end of the licensing period from the original purchase.
As a company, DigiCert has undertaken an unprecedented outreach with millions of emails and calls to educate customers about the potential impacts and solutions offered by DigiCert and have created instructions to help customers replace their SSL/TLS certificates. We simplified the process of replacing certificates, all while setting up an enhanced verification process and increasing the scalability of our PKI. We have also beefed up our validation staff and given them extensive training. The majority have already moved forward with replacements, but we are ready to help those who have yet to act.
What has been DigiCert’s main focus since completing the acquisition of Symantec Website Security and related PKI solutions in late 2017?
Since completing our acquisition of Symantec Website Security and related PKI solutions last year, we’ve invested an enormous amount of time and devoted the necessary resources to minimize the impact of the browse’sr distrust of Symantec certificates on our customers and partners. This first required replacing all Symantec backend systems with our own architecture and re-validating customers.
By completing this major effort, we have been able to manage the large volume of replacement certificates without notable delays for customers after the initial flurry of replacements began in December 2017. Our communications to customers have been extensive and we’ve worked hard to simplify the process.
DigiCert delivers certificate management and security solutions for the majority of the Global 2000. How do you see certificate management evolving in the near future?
As businesses accelerate digital transformation, they see new classes of physical assets that are connected to the Internet and require security. Organizations are challenged by the scale of their security needs (think IoT), the availability of highly trained workers and the rapidly growing attack vectors. Certificate management is critical for organizations, but it’s outside the regular workflow for many, including developers and IT managers. Companies need automation with certificate procurement, issuance, provisioning and renewals and we help simplify the lifecycle with technology and our API integrations.
Enterprise customers look for more than one-off issuance. They need a partner who can understand their workflows and provide automated management systems that fit their work cultures. They need a vendor with the expertise to track evolving threats and help them stay up-to-date. That has always been our focus at DigiCert and will continue to be. Customer first is our mantra.
What makes DigiCert unique in the marketplace? What are your strengths?
DigiCert was built around customer experience when our founders determined that acquiring and installing a digital certificate should be easier. That’s always been our focus: Innovating with customer-friendly product offerings, numerous platforms and tools to simplify certificate management, and a 24/7 customer support team to handle specific needs immediately and in a knowledgeable way.
We’ve also been very involved in industry standards work, which helps our customers stay at the forefront of evolving practices that address real-time risks. As an industry leader, we are constantly working to improve certificate ecosystems. For example:
- No CA can match our global support, with staff speaking dozens of languages and offices around the world to offer localized services. We also have the largest concentration of talent and innovators working on improving industry standards and enhancing our technology.
- We have built a modern, scalable infrastructure capable of reliably hosting the billions of certificates that the IoT and other connectivity requires. We also are working with others to advance forward-looking solutions such as quantum-safe cryptography and improved validation and trust within communities like blockchain.
- We support increased transparency around validation methods used to issue digital certificates, including which method was used to validate a particular certificate. We believe that any details about the issuance of digital certificates that does not need to be private should be public. We created a ballot that was passed in the CA/Browser Forum and continue to drive positive change.
- We are huge fans of automation and are working hard to support improved methods and tools to make it easier to manage certificates.
- And it doesn’t stop there, but stay tuned for more.
from Help Net Security https://ift.tt/2y6u58m
