Imperva Blog|Login|中文Deutsch日本語

ADC Hacker Intelligence Initiative

The Imperva Hacker Intelligence Initiative goes inside the cyber-underground and provides analysis of the trending hacking techniques and interesting attack campaigns.

Popular Tags: Hacking, Botnets, Search Engines, Automated Attacks, SQL Injection

Download Report

Assessing the Threat Landscape of DBaaS

This report does an in-depth analysis of malware that used a shared hosting database for its Command and Control and drop server, Imperva analyzes a new malware platform for cybercriminals: Database as a Service (DBaaS). The report concludes that by bringing data one step closer to hackers, DBaaS makes it possible for hackers to compromise an organization's database without accessing its network -- ultimately increasing the risk of a data breach.

Tags: Database Security, Cloud Security, DBaaS, Cybercriminals, Malware

Download Report

PHP SuperGlobals: Supersized Trouble

In the most recent Hacker Intelligence Initiative report, Imperva analyses vulnerabilities found in the SuperGlobal parameters of the PHP platform. Imperva finds that hackers are packaging higher levels of sophistication into simpler scripts and that a multi-step attack requires a multi-layered application security solution.

Tags: Application Security, SuperGlobals, PHP, Web Application Attacks

Download Report

Imperva's Web Application Attack Report (July 2013)

Examining today's application security threat landscape, Imperva finds that retailers suffer 2X as many SQL injection attacks as other industries. Report also shows that most applications are attacked more than four times a month, and the US retains its rank as the #1 source of web attacks in the world, among many other findings.

Tags: Application Security, SQL Injection, SQLi, Data Security, Web Application Attacks, Trends

Download Report

Get What You Give: The Value of Shared Threat Intelligence

Imperva's ADC analyzed real-world traffic from sixty Web applications in order to identify attack patterns. The report demonstrates that, across a community of Web applications, early identification of attack sources and attack payloads can significantly improve the effectiveness of application security. Furthermore, it reduces the cost of decision making with respect to attack traffic across the community. Here's how, based on the traffic analyzed by the ADC:
  • Multiple target SQL attackers generated nearly 6x their share of the population.
  • Multiple target comment spam attackers generated 4.3x their share of the population.
  • Multiple target RFI attackers generated 1.7x their share of the population (this amounted to 73% of total attacks).

Tags: Hackers, Hacking, Web Application Security, Database Security, Application Security, Remote File Inclusion, Local File Inclusion, Comment Spam

Download Report

Lessons Learned From the Yahoo! Hack

On December 2012, a hacker claimed to have breached Yahoo!'s security systems and acquired full access to certain Yahoo! databases, leading to full access on the server for that domain. Technically, we found that the hacker was able to determine the allegedly vulnerable Yahoo! application and the exact attack method, a SQL injection. This attack underscores the security problem posed by hosting third-party code – as is often done with cloud-based services. Our report explains:
  • How to protect third-party Web applications against SQL injection and other Web attacks.
  • Why security should always assume third-party code – coming from partners, vendors, mergers and acquisitions – contains serious vulnerabilities.
  • Putting in place legal requirements in a contract for what you will and will not accept from a security perspective and incorporating security due diligence for any merger or acquisition activity.

Tags: Data Security, Database Security, SQL Injection, Web Application Security

Download Report

Assessing the Effectiveness of Antivirus Solutions

How good is antivirus? How should enterprises invest in endpoint protection? Imperva collected and analyzed more than 80 previously non-cataloged viruses against more than 40 antivirus solutions. Imperva found:
  • Antivirus solutions have a difficult time detecting newly created viruses – While antivirus vendors may constantly work to update their detection mechanisms, the initial rate of detection of new viruses by antivirus solutions in the study was less than 5%. Antivirus solutions in the study were unable to provide complete protection since they are unable to keep up with virus propagation on the Internet.
  • Antivirus solutions lag in updating signatures –In some cases in the study, it took anti-virus solutions up to four weeks following the initial scan to detect a virus.
  • Investment in antivirus is misaligned – In 2011, Gartner reported that consumers spent $4.5 billion on antivirus while enterprises spent $2.9 billion, a total of $7.4 billion or more than a third of the total of $17.7 billion spent on security software. In addition, certain freeware solutions in the study proved equally or more effective than paid solutions.

Tags: Antivirus, Honey Pots, Hacker Forums, Data Security, Database Security

Download Report

Monitoring Hacker Forums

Imperva's second annual hacker forum analysis detects black market for social network fraud. By examining what information hackers seek out or share in forums, security teams can better understand where hackers are focusing their efforts. One thing is unmistakable: If organizations neglect SQL injection security, we believe that hackers will place more focus on those attacks.

Tags: Hackers, Hacking, Trends, SQL Injection, Web Application Security, Database Security, Application Security

Download Report

Denial of Service Attacks: A Comprehensive Guide to Trends, Techniques and Technologies

On hacker forums, denial of service remains the most discussed topic. Hackers continue to develop tools to optimize this attack method. Why? DDoS attacks do not seek to breach data integrity or privacy; they can be conducted without the requirement of identifying vulnerabilities to exploit the application. This report catalogs the latest trends, techniques and technologies deployed by hackers and gives security professionals specific steps to mitigate the threat.

Tags: Application Security, DDoS, DoS, Denial of Service, Web Application Attacks, Trends

Download Report

Imperva's Web Application Attack Report (July 2012)

Imperva's ADC finds that the median annual attack incidents was 274 times a year. The average attack incident for the observed Web applications lasted seven minutes and 42 seconds, but the longest attack incident lasted an hour and 19 minutes.

Tags: Application Security, SQL Injection, SQLi, Data Security, Web Application Attacks, Trends

Download Report

A CAPTCHA in the Rye

How effective are CAPTCHAs as a security mechanism against malicious automation? We report and analyze four case studies and draw conclusions as to the best ways to implement CAPTCHAs as an integrated part of a security strategy. Specifically, security teams should use novel CAPTCHA methods that make the CAPTCHA into something enjoyable, like a mini-game. Also, we help identify how to present a CAPTCHA only when users exhibit suspicious behavior by implementing various automation detection mechanisms.

Tags: CAPTCHA, Web Security, Web Application Attacks, Hacking

Download Report

Dissecting a Hacktivist Attack

The fundamental tenet of Web 2.0, user-generated content, is also the Achilles Heel from a security standpoint. Why? Allowing the upload of user-generated content to the website can be extremely dangerous as the server which is usually considered by other users and the application itself as "trusted" now hosts content that can be generated by a malicious source.

Tags: Hacktivist, Web Application Attacks, Hacking, Lulzsec, Remote File Inclusion, RFI, Passwords

Download Report

Automation of Attacks

How do hackers automate? What do they automate? And most importantly: How can security teams block automated attacks? The latest Hacker Intelligence Initiative from Imperva's Application Defense Center will help you answer these questions and many more.

Tags: Automated Web Application Attacks, Hacking, SQL Injection, SQLi, Remote File Inclusion, RFI, sqlmap, Havij, NetSparker, libwww-perl

Download Report

Remote and Local File Inclusion Vulnerabilities 101

Remote and local file inclusion (RFI/LFI) attacks are a favorite choice for hackers and many security professionals aren't noticing. RFI/LFI attacks enable hackers to execute malicious code and steal data through the manipulation of a company's web server. RFI was among the four most prevalent Web application attacks used by hackers in 2011. In fact, RFI/LFI was used most prominently by hacktivists. Most recently, a military dating website was breached using RFI/LFI by hacktivist group Lulzsec. RFI and LFI attacks take advantage of vulnerable PHP Web application parameters by including a URL reference to remotely hosted malicious code, enabling remote execution. PHP is a programming language designed for Web development and is in use across more than 77 percent of applications on the Internet.

Tags: File Inclusion, Remote File Inclusion, RFI, LFI, Web Application Attacks, Hacktivist, Hacking

Download Report

The Anatomy of an Anonymous Attack

This ADC report details the never-before-seen details on an attack by hacktivist group 'Anonymous' against a high-profile unnamed target during a 25 day period in 2011. The Hacker Intelligence Summary Report - The Anatomy of an Anonymous Attack offers a comprehensive analysis of the attack including a detailed timeline of activities from start to finish, an examination of the hacking methods utilized as well as insights on the use of social media to recruit participants and coordinate the attack.

Tags: Anonymous, Web Application Security, Web Application Attacks, SQL Injection, Data Security, Database Security, Hacktivist, Hacking

Download Report

Imperva's Web Application Attack Report (January 2012)

Imperva monitored and categorized attacks across the internet targeting 40 different enterprise and government web applications. The WAAR outlines the frequency, type and geography of origin of each attack to help security professionals better prioritize vulnerability remediation.

Tags: Application Security, Remote File Inclusion, RFI, SQL Injection, SQLi, Local File Inclusion, LFI, Cross Site Scripting, XSS, Directory Traversal, DT, Data Security, Web Application Attacks

Download Report

Enterprise Password Worst Practices

In 2009, Imperva published a report on 32 million breached passwords entitled "Consumer Password Worst Practices." Since then, successive breaches have highlighted consumers' inability to make sufficient password choices. Enterprises can no longer rely on employees, partners or consumers when it comes to password security. Instead, responsibility rests on enterprises to put in place proper password security policies and procedures as a part of a comprehensive data security discipline. Passwords should be viewed by security teams as highly valuable data - even if PCI or other security mandates don't apply. This paper guides enterprises to rectify poor password management practices.

Tags: Data Security, Passwords, Trends, Password Worst Practices

Download Report

Security Trends 2012

Hacking is inherently innovative and constantly changing. As 2012 approaches, security team will need to adapt to a changing threatscape as cyber security remains one of the most dynamic and fluid disciplines worldwide. Imperva's Application Defense Center (ADC), led by Imperva CTO Amichai Shulman, is exclusively focused on advancing the practice of data security to help companies shield themselves from the threat of hackers and insiders. For 2012, the ADC has assembled a comprehensive set of predictions designed to help security professionals prepare for new threats and attacks in cyber space.

Tags: Data Security, Security Trends, DDoS, Social Media, Compliance, HTML 5, SSL, Database Security, Application Security, SQL

Download Report

Monitoring Hacker Forums

As a part of Imperva's hacker intelligence initiative, we monitor hacker forums to understand many of the technical aspects of hacking. Forums are the cornerstone of hacking - they are used by hackers for training, communications, collaboration, recruitment, commerce and even social interaction. Forums contain tutorials to help curious neophytes mature their skills. Chat rooms are filled with technical subjects ranging from advice on attack planning and solicitations for help with specific campaigns. Commercially, forums are a marketplace for selling of stolen data and attack software. Most surprisingly, forums build a sense of community where members can engage in discussions on religion, philosophy and relationships.

Tags: Hackers, Hacking, Trends, LulzSec, Hacktivist, DDoS, SQL Injection, Web Application Security, Database Security, Application Security

Download Report

An Anatomy of a SQL Injection Attack (SQLi)

This month's report from Imperva's Hacker Intelligence Initiative (HII) focuses on the rise in SQL Injection (SQLi) attacks on the Web. Dominating headlines for the past year, SQLi has become a widely-known, even outside the circle of security professionals. And for good reason: SQL injection is probably the most expensive and costly attack since it is mainly used to steal data. Famous breaches, including Sony, Nokia, Heartland Payment Systems and even Lady Gaga's Web sites were compromised by hackers who used SQL injection to break-in to the application's backend database. LulzSec, the notorious hacktivist group, made SQLi a key part of their arsenal. This report details how prevalent SQL injection attacks have become, how attacks are executed and how hackers are innovating SQLi attacks to bypass security controls as well as increase potency.

Tags: SQLi, SQL Injection, LulzSec, Hacktivist, Web Application Attacks, Data Security

Download Report

The Convergence of Google and Bots: Searching for Security Vulnerabilities using Automated Botnets

This Imperva's Hacker Intelligence Initiative (HII) report reveals that hackers are leveraging the power of search engines to conduct cyber reconnaissance. Hackers, armed with a browser and specially crafted search queries ("Dorks"), are using botnets to generate more than 80,000 daily queries, identify potential attack targets and build an accurate picture of the resources within that server that are potentially exposed. Automating the query and result parsing enables the attacker to issue a large number of queries, examine all the returned results and get a filtered list of potentially exploitable sites in a very short time and with minimal effort. As searches are conducted using botnets, and not the hacker's IP address, the attacker's identity remains concealed.

Tags: Google Hacking, Botnets, Bots, SQL Injection, Data Security

Download Report

Imperva's Web Application Attack Report (July 2011)

As a part of our ongoing Hacker Intelligence Initiative, the Imperva Application Defense Center (ADC) monitored and categorized individual attacks across the internet over a period of six months, December 2010 through May 2011. This research encompasses attacks witnessed via onion router (TOR) traffic as well as attacks targeting 30 different enterprise and government Web applications.

Tags: Application Security, SQL Injection, RFI, XSS, Cross-Site Scripting, Data Security, Web Application Attacks

Download Report

Search Engine Poisoning (SEP)

In this second report from Imperva's Hacker Intelligence Initiative (HII), we describe a Search Engine Poisoning (SEP) campaign from start to finish. SEP abuses the ranking algorithms of search engines to promote an attacker-controlled website that contains malware. Imperva's Application Defense Center (ADC) has witnessed these types of automated attack campaigns which cause search engines to return high-ranking Web pages infected with malicious code that references an attacker-controlled website.

Tags: Search Engine Poisoning, SEP, Search Engines, Malware

Download Report

Remote File Inclusion

We begin our first report by describing an attack which usually flies under the radar – Remote File Inclusion (RFI). Although these attacks have the potential to cause as much damage as the more popular SQL Injection and Cross-Site Scripting (XSS) attacks, they are not widely discussed. HII has documented examples of automated attack campaigns launched in the wild. This report pinpoints their common traits and techniques, as well as the role blacklisting can play in mitigating them.

Tags: Google Hacking, Web Application Attacks, Buffer Overflow, CSRF, SQL Injection, Cross-Site Scripting, XSS, Search Engine Poisoning, SEP, Botnets, Remote File Inclusion, RFI

Popular Tags: Hacking, Botnets, Search Engines, Automated Attacks, SQL Injection