In March, researchers witness increased probing for the vulnerabilities, continue regular scans
Command injection attacks amongst the most common attack types followed by reconnaissance/fuzzing, and attacks against application vulnerabilities
India, July 22, 2021: While analysing the data from the attacks blocked by their systems over the past two months, researchers of Barracuda, a trusted partner and leading provider of cloud-enabled security solutions, identified hundreds of thousands of automated scans and attacks per day, with the numbers sometimes spiking into the millions. The data also points towards thousands of scans per day for the recently patched Microsoft and VMware vulnerabilities.
First disclosed in March 2021, the Microsoft vulnerability a.k.a. Hafnium is a server-side request forgery (SSRF) vulnerability in Exchange, which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server. From the information publicly available, CVE-2021-26855 is used to identify vulnerable systems, and the remaining vulnerabilities are chained with this vulnerability to gain access and perform further exploitation, including dropping web shells into the exploited systems.
 |
There has been regular probing for CVE-2021-21972 with some downturn in the scanning.
Speaking on the latest findings, Murali Urs, Country Manager-Barracuda Networks India said, “Software vulnerabilities, especially hard-hitting ones, continue being scanned for and have been exploited for quite some time after the release of patches and mitigations. Attackers understand that defenders don’t always have the time or bandwidth to keep up with patches all the time, and things slide—providing them with an easy way into the network. We are expecting to see some uptick in the scans from time to time as attackers move through the list of known high-impact vulnerabilities.”
While analyzing attacks, Barracuda researchers also identified their patterns. Bots followed the course of a workday to perform their attacks, which has now shifted to workweek. Both these insights show that most attackers seem to take the weekend off, even when running automated tasks. This is likely because it is easier to hide in the crowd when attempting various activities rather than setting off alarms by going after less used systems on weekends.
Some of the most common attack types included attempts at reconnaissance/fuzzing, and attacks against application vulnerabilities (WordPress was the most popular). Typically, SQL injection attacks take place followed by command injection attacks and then any other type of attack. However, this time, command injection was by far the leader that peaked over two weeks in June and then went back down to the normal traffic levels. The remaining attacks were at more or less the expected levels, with no specific attack patterns to be called out in the different categories.
Finally, the levels of HTTPS traffic and the versions of the protocols used were analysed where the latest TLS1.3 emerged as the clear leader, followed by TLS1.2. This is good news, given that these are the most secure protocols. While there are some deployments still using plain HTTP but the traffic generated through it is higher in volume than the older and insecure SSL/TLS protocols.
“To gain protection against automated attacks taking advantage of known software vulnerabilities, organizations should look for a WAAP (Web Application and API Protection services) solution that includes bot mitigation, DDoS protection, API security, and credential stuffing protection — and make sure it is properly configured.” Urs added.
About Barracuda
At Barracuda we strive to make the world a safer place. We believe every business deserves access to cloud-enabled, enterprise-grade security solutions that are easy to buy, deploy, and use. We protect email, networks, data and applications with innovative solutions that grow and adapt with our customers’ journey. More than 200,000 organizations worldwide trust Barracuda to protect them — in ways they may not even know they are at risk — so they can focus on taking their business to the next level. For more information, visit barracuda.com. Barracuda Networks, Barracuda and the Barracuda Networks logo are registered trademarks or trademarks of Barracuda Networks, Inc. in the U.S. and other countries.
Speaking on the latest findings, Murali Urs, Country Manager-Barracuda Networks India said, “Software vulnerabilities, especially hard-hitting ones, continue being scanned for and have been exploited for quite some time after the release of patches and mitigations. Attackers understand that defenders don’t always have the time or bandwidth to keep up with patches all the time, and things slide—providing them with an easy way into the network. We are expecting to see some uptick in the scans from time to time as attackers move through the list of known high-impact vulnerabilities.”
While analyzing attacks, Barracuda researchers also identified their patterns. Bots followed the course of a workday to perform their attacks, which has now shifted to workweek. Both these insights show that most attackers seem to take the weekend off, even when running automated tasks. This is likely because it is easier to hide in the crowd when attempting various activities rather than setting off alarms by going after less used systems on weekends.
Some of the most common attack types included attempts at reconnaissance/fuzzing, and attacks against application vulnerabilities (WordPress was the most popular). Typically, SQL injection attacks take place followed by command injection attacks and then any other type of attack. However, this time, command injection was by far the leader that peaked over two weeks in June and then went back down to the normal traffic levels. The remaining attacks were at more or less the expected levels, with no specific attack patterns to be called out in the different categories.
 |
Finally, the levels of HTTPS traffic and the versions of the protocols used were analysed where the latest TLS1.3 emerged as the clear leader, followed by TLS1.2. This is good news, given that these are the most secure protocols. While there are some deployments still using plain HTTP but the traffic generated through it is higher in volume than the older and insecure SSL/TLS protocols.
 |
“To gain protection against automated attacks taking advantage of known software vulnerabilities, organizations should look for a WAAP (Web Application and API Protection services) solution that includes bot mitigation, DDoS protection, API security, and credential stuffing protection — and make sure it is properly configured.” Urs added.
About Barracuda
At Barracuda we strive to make the world a safer place. We believe every business deserves access to cloud-enabled, enterprise-grade security solutions that are easy to buy, deploy, and use. We protect email, networks, data and applications with innovative solutions that grow and adapt with our customers’ journey. More than 200,000 organizations worldwide trust Barracuda to protect them — in ways they may not even know they are at risk — so they can focus on taking their business to the next level. For more information, visit barracuda.com. Barracuda Networks, Barracuda and the Barracuda Networks logo are registered trademarks or trademarks of Barracuda Networks, Inc. in the U.S. and other countries.
Advertisements