How Cloudflare helped mitigate the Atlassian Confluence OGNL vulnerability before the PoC was released

On August 25, 2021, Atlassian released a security advisory for their Confluence Server and Data Center. The advisory highlighted an Object-Graph Navigation Language (OGNL) injection that would result in an unauthenticated attacker being able to execute arbitrary code.

A full proof of concept (PoC) of the attack was made available by a security researcher on August 31, 2021. Cloudflare immediately reviewed the PoC and prepared a mitigation rule via an emergency release. The rule, once tested, was deployed on September 1, 2021, at 15:32 UTC with a default action of BLOCK and the following IDs:

100400 (for our legacy WAF)
e8c550810618437c953cf3a969e0b97a (for our new WAF)

All customers using the Cloudflare WAF to protect their self-hosted Confluence applications have automatically been protected since the new rule was deployed last week. Additionally, the Cloudflare WAF started blocking a high number of potentially malicious requests to Confluence applications even before the rule was deployed.

And customers who had deployed Cloudflare Access in front of their Confluence applications were already protected even before the emergency release. Access checks every request made to a protected hostname for a JSON Web Token (JWT) containing a user’s identity. Any unauthenticated users attempting this exploit Continue reading

Open-Source DMVPN Alternatives

When I started collecting topics for the September 2021 ipSpace.net Design Clinic one of the subscribers sent me an interesting challenge: are there any open-source alternatives to Cisco’s DMVPN?

I had no idea and posted the question on Twitter, resulting in numerous responses pointing to a half-dozen alternatives. Thanks a million to @MarcelWiget, @FlorianHeigl1, @PacketGeekNet, @DubbelDelta, @Tomm3h, @Joy, @RoganDawes, @Yassers_za, @MeNotYouSharp, @Arko95, @DavidThurm, Brian Faulkner, and several others who chimed in with additional information.

Here’s what I learned:

Open-Source DMVPN Alternatives

When I started collecting topics for the September 2021 ipSpace.net Design Clinic one of the subscribers sent me an interesting challenge: are there any open-source alternatives to Cisco’s DMVPN?

Here’s what I learned:

What’s new in Calico Enterprise 3.9: Live troubleshooting and resource-efficient application-level observability

We are excited to announce Calico Enterprise 3.9, which provides faster and simpler live troubleshooting using Dynamic Packet Capture for organizations while meeting regulatory and compliance requirements to access the underlying data. The release makes application-level observability resource-efficient, less security intrusive, and easier to manage. It also includes pod-to-pod encryption with Microsoft AKS and AWS EKS with AWS CNI.

Live troubleshooting

Enterprises that want to carry out live troubleshooting in their production environments face the following challenges when doing packet capture at an organizational scale:

Difficult to limit access to packet capture by organizational roles
Takes hours to days to setting up packet capture instead of making part of the code
Extremely difficult to capture the right amount of data to lessen storage and compute cost
Spend days and weeks to correlate the data collected from different Kubernetes components such as namespaces, workloads, pods, microservices

With Dynamic Packet Capture, organizations can enable DevOps, SREs, service owners to collect the data that they need when they need it. They can filter the data based on protocol and port to fine-tune their capture for faster debugging and subsequent analysis for shorter time-to-resolution. With just-in-time data collection and built-in smart correlation, Continue reading

Tier 1 Carriers Performance Report: August, 2021

The post Tier 1 Carriers Performance Report: August, 2021 appeared first on Noction.

The CXL Roadmap Opens Up The Memory Hierarchy

The system world would have been a simpler place if InfiniBand had fulfilled its original promise as a universal fabric interconnect for linking all manner of devices together within a system and across systems. …

The CXL Roadmap Opens Up The Memory Hierarchy was written by Timothy Prickett Morgan at The Next Platform.

AWS EC2 Pioneer on Early Days, Next Wave

Dave Brown remembers when Amazon executives would pop into their small office in Cape Town, populated by the entire EC2 team of fourteen, and tell them they would be working for a billion-dollar business one day. …

AWS EC2 Pioneer on Early Days, Next Wave was written by Nicole Hemsoth at The Next Platform.

Network Break 349: T-Mobile Fails To Protect Millions Of Customer Records; Ciena Buys Vyatta Router

Today's Network Break podcast opines on why Ciena acquired the Vyatta router from AT&T (and why AT&T wanted to sell), how T-Mobile failed current and former customers via a breach that exposed sensitive details on millions of people, financial results from HPE and Dell Technologies, and more.

Network Break 349: T-Mobile Fails To Protect Millions Of Customer Records; Ciena Buys Vyatta Router

The post Network Break 349: T-Mobile Fails To Protect Millions Of Customer Records; Ciena Buys Vyatta Router appeared first on Packet Pushers.

Container Security Best Practices

A specialist responsible for container security should have an understanding of the infrastructure and proficiency in Linux and Kubernetes.

What’s new with Cloudflare for SaaS?

This past April, we announced the Cloudflare for SaaS Beta which makes our SSL for SaaS product available to everyone. This allows any customer — from first-time developers to large enterprises — to use Cloudflare for SaaS to extend our full product suite to their own customers. SSL for SaaS is the subset of Cloudflare for SaaS features that focus on a customer’s Public Key Infrastructure (PKI) needs.

Today, we’re excited to announce all the customizations that our team has been working on for our Enterprise customers — for both Cloudflare for SaaS and SSL for SaaS.

Let’s start with the basics — the common SaaS setup

If you’re running a SaaS company, your solution might exist as a subdomain of your SaaS website, e.g. template.<mysaas>.com, but ideally, your solution would allow the customer to use their own vanity hostname for it, such as example.com.

The most common way to begin using a SaaS company’s service is to point a CNAME DNS record to the subdomain that the SaaS provider has created for your application. This ensures traffic gets to the right place, and it allows the SaaS provider to make infrastructure changes without Continue reading

BGP with Link State (LS) and the reasons for BGP-LS use

The post BGP with Link State (LS) and the reasons for BGP-LS use appeared first on Noction.

Tailoring SD-WAN to fit your needs

SD-WAN resources What is SD-WAN and what does it mean for networking, security, cloud? 10 SD-WAN features you're probably not using but should be SD-WAN may be the key to smart network services SD-WAN and analytics: A marriage made for the new normal Native SD-WAN monitoring tools are not enough, survey says Why is it that we always seem to think that we can adopt a technology that has seriously revolutionary pieces by just buying it and hooking it up? This, despite the undeniable fact that everything in tech is getting more sophisticated, more complex? Software-defined WAN is a technology like that, and because all SD-WANs aren’t the same, or even close to the same, you’ll have to do some digging to make SD-WAN your own.To read this article in full, please click here

How to scale a Wi-Fi network

Although it’s tempting to just deploy more access points (APs) when expanding your Wi-Fi network, there are many considerations to take in account first in order to get a high-performing result without overspending. Wi-Fi resources Test and review of 4 Wi-Fi 6 routers: Who’s the fastest? How to determine if Wi-Fi 6 is right for you Five questions to answer before deploying Wi-Fi 6 Wi-Fi 6E: When it’s coming and what it’s good for Step one is to clearly understand what you are trying to achieve, then analyze the current setup so you know how well the network serves the coverage area, and only then go about designing and deploying the APs.To read this article in full, please click here

What You Can Learn from the AWS Tokyo Outage

Jason Yee Jason is director of advocacy at Gremlin where he helps companies build more resilient systems by learning from how they fail. He also helps lead Gremlin's internal chaos engineering practices to make it more reliable. In the movies, it seems like Tokyo is constantly facing disasters — natural ones in the forms of earthquakes and tsunamis, and unnatural ones like giant kaiju and oversized robots. On the morning of Sept. 1, the mechanized behemoth was Amazon Web Services. At around 7:30 am JST, AWS began experiencing networking issues in its AP-Northeast-1 region based in Tokyo. The outage affected business across all sectors, from financial services to retail stores, travel systems and telecommunications. Despite the troubles with not being able to access money, purchase goods, travel or call each other, the Japanese people demonstrated resilience, proving that at least some things from the movies are true. However, the financial losses due to the outage are expected to be huge. After the six-hour outage, AWS explained the issue

Non-Stop Forwarding (NSF) 101

Non-Stop Forwarding (NSF) is one of those ideas that look great in a slide deck and marketing collaterals, but might turn into a giant can of worms once you try to implement them properly (see also: stackable switches or VMware Fault Tolerance).

NSF has been around for at least 15 years, so I’m positive at least some vendors got most of the details right; I’m also pretty sure a few people have scars to prove they’ve been around the non-optimal implementations.

Non-Stop Forwarding 101

What Net Admins Must Know about NicheStack Vulnerabilities

Researchers have found numerous new vulnerabilities impacting the NicheStack TCP/IP stack. These vulnerabilities could lead to heightened risks to technology managing critical infrastructure.

Cutting Through the Fog Surrounding Private 5G Networks

A checklist for enterprises interested in the emerging private 5G network wireless opportunity.

Best Questions to Ask In Job Interviews

Usually interviews are not supposed to make the person anxious and uncomfortable. As a part of an interviewer the questions should be asked in an extremely comfortable yet appropriate way, which does not make the person feel like he is being scrutinized or grilled. There are multiple techniques and ways to go about this process. However, when the interviewer asks the person whether or not they want to ask any questions regarding the company, their role, the job or position being offered, here are a few questions that can easily make one understand and get a deeper insight on what is being offered to them.

One needs to understand that as much as being able to answer the interviewer’s question is important; it is also considerably important to ask them the following significant questions. This will make them come off as a well balanced, ideal, and informative person which in return can help them stand out from others.

What Could Your Day-To-Day responsibilities look like?

Getting a deeper insight on the functionality of the job is extremely ideal and appropriate to ask during an interview. One has to know what their daily work load, their responsibilities, and the expectations could Continue reading

« Previous 1 … 693 694 695 696 697 … 3,866 Next »