163 new advanced evasion techniques discovered
Posted on 10 October 2011.
Stonesoft announced it has delivered 163 new advanced evasion technique (AET) samples for global vulnerability coordination. The new samples include AETs over a number of various protocols, including IPv4, IPv6, TCP and HTTP.

Since the discovery of AETs a year ago, Stonesoft has continued extensive research in the area and has now delivered a new set of 163 AET samples to CERT-FI (Finnish national computer security incident response team) for global vulnerability coordination.

The set is comprised of 54 atomic evasions and 109 combinations that can be further combined with each other or with the evasions in the previous releases to create new AETs. They work efficiently also over IPv6, which results in increased security risks and challenges.

In Stonesoft’s tests, the latest samples of AETs have successfully bypassed intrusion prevention system (IPS) devices currently on the market. As the number of AETs and their potential combinations is constantly growing, building efficient protection against them requires profound understanding of network traffic. However, most network security vendors still demonstrate a lack of understanding on where the problem stems and how to resolve it.

“Network security vendors have now had more than a year to provide their customers protection against AETs, but unfortunately we still have not seen much success in this area. Very few vendors have truly understood the magnitude of the problem, while some are struggling to provide some kind of protection. Most of the vendors who acknowledge the problem are incapable of building a working solution - instead, they are keeping themselves busy doing temporary and inflexible fixes. The rest just ignore the issue and do nothing,” said Ilkka Hiidenheimo, founder and CEO of Stonesoft.

According to Stonesoft, network security must be regarded as a dynamic, constantly evolving process. A security vendor who still uses 10-year old protocol normalization methods in order to look for exploits or other malicious activities is prone to miss new threats. The core functionality of the protocol parsing cannot be static – instead, it has to evolve in order to meet the constantly changing threats. While new exploits, vulnerabilities and even attack vectors are constantly discovered and must be addressed quickly by security products, these new evasions require equally dynamic and fast responses.





Spotlight

Operation Pawn Storm: Varied targets and attack vectors, next-level spear-phishing tactics

Posted on 23 October 2014.  |  Targets of the spear phishing emails included staff at the Ministry of Defense in France, in the Vatican Embassy in Iraq, military officials from a number of countries, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //