Akamai Blog

Does Firefox 23 have support for TLSv1.2? Please fix NSS and support TLSv1.2 As of now only IE and Opera are the ones which I'm aware of that support TLSv1.2. There is a vulnerability for BEAST against SSL 3.0/TLSv1.0 With more widespread use of HTTPS which isn't a bad thing, it would help that all browsers support the latest security recommendations. https://blogs.akamai.com/2012/05/what-you-need-to-know-about-beast.htm…

In addition to this: Carrier grade NAT ISPs sometimes have global scope ipv6s assigned, and if the other endpoint has ipv6 support, too, you can breakout easily using the assigned ipv6. Rather than that I would recommend reading up on DNS exfiltration techniques [1] and things like pwnat [2] that use faked SNMP reply packets that make routers think they forgot to let a data packet through for hop traces. And if you have the time, I'd recommend to use websockets as a tunneling protocol because it's very flexible in its payload size and allows compressions via websocket extensions and the srv flags. I wrote a detailed article that explains the WS13 protocol and all its quirks [3] Additionally to that it's good to know the limitations of a SOCKS proxy, hence that's what most "easy to use" implementations provide. Spoiler: forget ipv6 via socks5 proxies. I also wrote a detailed article about its quirks [4] I'm currently experimenting with the idea of a DNS protocol implementation that uses multicast DNS service discovery to find local peers and that uses DNS exfiltration techniques to breakout of a CGNAT, but I'm not there yet to write a detailed article about it. It's current research for my stealth browser project. [1] https://blogs.akamai.com/2017/09/introduction-to-dns-data-exfiltration… [2] https://github.com/samyk/pwnat [3] https://cookie.engineer/weblog/articles/implementers-guide-to-websocke… [4]…

> Do any site operators actually block non-Google search engine crawlers because being listed DDG/Bing/etc isn't worth the extra cost of serving the crawler? Many website operators do actually block crawlers from non Google search engines and it's because the cost of being crawled isn't worth it to them. Here's a good quote from one such webmaster: As a webmaster I get a bit tired of constantly having to deal with the startup crawler du jour. From law firms looking for DMCA violations to verticals search engines, to image aggregators, to company intelligence resellers… It feels to me that everybody and their brother has gotten into spidering sites. With 10,000s of pages that have content that is only relevant to a targeted audience who is perfectly able to find us on the majors, I do not hesitate to block (and possibly ban) when I see an aggressive crawler that does not provide me or my customers with direct benefits. Taken from http://www.skrenta.com/2008/04/cuill_is_banned_on_10000_sites.html > Perhaps other search engines should spoof GoogleBot. Browsers have being doing that since forever spoofing Netscape (Mozilla), Safari, etc. for the same reason. People have tried this and it doesn't work. Google provides ways to check to make sure traffic is coming from Google IP addresses and practitioners and academics study how to spot fake…

What Cloudflare's announced is more than just DOM reconstruction, though. They sound very different to the likes of Opera Mini Turbo or Amazon Silk's Cloud Browser or Chrome's Fly Wheel...[0] In Cloudflare's case, the rendering happens on the server and only rasterization commands are sent to the clients similar to AWS NICE [1]. As a security product (if you trust Cloudflare), browser isolation sounds super tempting on-paper. As they mention in the blogspot, an ashtonishing 70% of the exploits are through various forms of Phishing and other attacks in the browser. DNS based blocklists (and Google SafeBrowsing) which form a viable defence against Phising can only protect you from so much [2]. So, my point is, regardless of the thin-client / thick-client cycle, there's a real value to this product. It isn't for everyone but there's no denying its utility, especially when you consider the fact that most SaaS tools are browser-friendly. I have also been following MightyApp.com that is trying to do something similar but for consumers and with focus on productivity. It is interesting to see how this would play out. If there's a huge market for this, Google is sure to pounce on it too, and then things will get real interesting... as if AMP, WebComponents [2] and Privacy Sandbox [3] weren't already enough. [0] https://news.ycombinator.com/item?id=19774768 [1] https://aws.amazon.com/hpc/dcv/ [2]…

I'm running OpenNTPD on all my devices (laptops, servers, VMs) and as far as I can tell they are in sync. Both amongsts themselves, as well as with other devices that are running other NTP implementations. I've heard other people claiming that OpenNTPD is not accurate enough and what not, but my anecdata says it performs well enough. Do you happen to have any specific gripes with it ? Is it the timekeeping algorithm that is lacking ? Sibling comment mentioned leap seconds, and that's unlikely to change. AFAIK, for 'proper' leap second support, the daemon must support it (to parse the announcement from the upstream NTP) as well as the OS. Gathering from I've read on OpenBSD's mailing lists, leap second support in the kernel is not a priority -- to say the least. Seeing the fallout on other OSes, I'd say it's a sound decision. On a similar note, Google introduced leap smearing to not deal with introducing leap seconds across all of its' servers[1]. Several other actors, such as Amazon[2] and Akamai followed suite. [1] https://googleblog.blogspot.fr/2011/09/time-technology-and-leaping-sec… [2] https://aws.amazon.com/blogs/aws/look-before-you-leap-the-coming-leap-… [3] https://blogs.akamai.com/2016/11/planning-for-the-end-of-2016-a-leap-s…

See Akamai's response: https://blogs.akamai.com/2013/04/clarifying-state-of-the-internet-repo… ("This data encompasses connections from both residential and business connections, and as such, represents a blend of the observed connection speeds. (The report has never claimed to measure only residential traffic.) Having said that, we believe that the number of residential connections to Akamai's platform greatly outnumbers the number of business connections, so the potential skew caused by higher speed business connections should be minimized.") Also, the U.S. does pretty well on Ookla's survey too, compared to similarly-situated countries: http://www.netindex.com. The U.S. average clocks in at 24.1 megabits. Canada and Australia, two similarly sprawl-y Anglo countries clock in at 21.8 and 14.4, respectively. Germany, France, and the U.K. beat us, though, at 25.4, 33.4, at 26.9 megabits, respectively. However, drilling down, you can see that sparsely-populated central and western states drag down our overall average: http://www.netindex.com/download/2,1/United-States. In the densely-populated Northeast, speeds are generally above 30 megabits. Virginia is 30.3, Pennsylvania is 29.7, New York 30.2, New Jersey 38.2, Maryland 36.8, Delaware 36.0, Massachusetts 34.0, Connecticut 31.4. These are the places in the U.S. that are comparably dense and urbanized as continental Europe.

The last link was a very interesting read - I wonder if BBC or anyone else has open-sourced a video streaming and editing system like that. Connecting this to HTTP range requests, the edited video feed can consist of a list of the exact byte ranges that the clients need to download and play. Found this description of how Akamai uses range requests to serve low-latency streams: https://blogs.akamai.com/2020/11/using-ll-hls-with-byte-range-addressi…

It was last updated in 2017 per the date at the top, but yes, it's an older article. This post indicates that 3p cookie issues only affect SSO providers without a hostname that lives within the primary websites domains: https://blogs.akamai.com/2020/01/cookies-single-sign-on-and-you.html (so SaaS offerings without domain masking). Is that your understanding? Here's an interesting post on the samesite implications: https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death…

> Until the day when ipv6-only connectivity becomes practical/commonplace. IIRC, this has already occurred for mobile phones. * https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mobile-networ… It's (one off?) the reasons why Apple mandates that apps work with IPv6-only networks: * https://developer.apple.com/support/ipv6/

> curious why the term "skimmer" is used It has a history of this usage, eg https://blogs.akamai.com/2020/01/protecting-websites-from-magecart-and… It relates the attack to something a lay person can easily absorb. As their security blog is written for a lay person (ie, IT manager type person who has some understanding of infosec but probably not their day job), who will not care too much about the nuances of how the attack is perpetrated, the term serves them well.

https://blogs.akamai.com/2020/06/largest-ever-recorded-packet-per-seco… Akamai's blog post about this attack.

You can exfiltrate data using regular DNS requests, by hiding the data in the host part of the query. The authoritative name server for the domain can then extract out and re-assemble the data. https://blogs.akamai.com/2017/09/introduction-to-dns-data-exfiltration…

No, IRR assignments are only regional in terms of the company requesting them. A European company can use their RIPE resources anywhere in the world without "delegating" them. Yes, filter lists generated by recursively resolving IRR AS-SETs and RPKI can prevent incidents like this, if they were universally applied. Note that origin validation on its own (i.e. what RPKI does) does not prevent malicious attacks, which can just spoof the right origin. Some Tier 1's - most notably NTT - also use a mechanism called "Peer Lock", where an ASN can specify that it will only ever use a given set of transit providers (i.e. "NTT should never receive a Google prefix from a China Telecom peer"), which would have prevented this. https://archive.nanog.org/sites/default/files/Snijders_Everyday_Practi… https://blogs.akamai.com/Minimizing%20BGP%20Hijacking%20Risk_2018-10-2…

CPU usage (but not memory usage) seems to be addressed by the section "Brotli can compress faster than gzip and still produce smaller files", quoting https://blogs.akamai.com/2016/02/understanding-brotlis-potential.html?

memcached reflection: https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html

my recollection is that it decompresses fine/performantly, let me see if I can dig up an article. https://blog.codinghorror.com/zopfli-optimization-literally-free-bandw… https://blogs.akamai.com/2016/02/understanding-brotlis-potential.html one more: https://medium.com/front-end-hacking/reduce-your-javascript-bundle-siz…

That's not correct - while any HTTP/2 capable servers along the path may implement server push, the most important one is the closest server to the user (i.e. the CDN). The only requirement is that the intermediate servers must not strip out the server push headers/tags, so that the edge server knows what to actually push. It's quite possible to have your own server provide HTTP/1.1 and still take advantage of server push, and this is a usecase supported by Akamai[1], Cloudflare[2], and I suspect other CDNs (can't find details) - you may get better performance using HTTP/2 on that intermediate link, but that's less likely to be because of server push. [1]: https://blogs.akamai.com/2016/04/are-you-ready-for-http2-server-push.h… [2]: https://blog.cloudflare.com/announcing-support-for-http-2-server-push-…

I just naturally assumed Akamai would use anycast for their CDN, but it is actually DNS based[1]. No mention of if their DNS is anycasted, one would presume so. [1] https://blogs.akamai.com/2013/04/serving-at-the-edge-good-for-performa…

I garbled my post :( Pull the plug /s Don't allow password-based SSH access. https://blogs.akamai.com/2015/09/xor-ddos-threat-advisory.html https://isc.sans.edu/forums/diary/XOR+DDOS+Mitigation+and+Analysis/198… example (first Google result)

I came across this a while back and is what I tell all the newer people that I mentor: https://blogs.akamai.com/2013/10/you-must-try-and-then-you-must-ask.ht… Some people tend to miss the "You MUST try" part. I am more than happy to take a million questions of the "I tried x, y, z and saw a, b, and c; what's up?" variety. Where it gets frustrating are questions like "I haven't really tried to hunt this down yet, but how do I do <thing>?"

Akamai published a blog post about their role: https://blogs.akamai.com/2014/11/lets-encrypt-boosts-push-from-ssl-to-…

This would be a more compelling rebuttal to Willem's post if Akamai hadn't confirmed his central thesis: https://blogs.akamai.com/2014/04/heartbleed-update-v3.html

Willem, Thanks for the well-reasoned set of claims for us to evaluate. We are still looking at them, but a critical one is accurate: our own implementation of the secure memory area did not include the CRT values. More here: https://blogs.akamai.com/2014/04/heartbleed-update-v3.html

I didn't but akamai itself did [1]: To test this belief, our engineers have rebuilt every Akamai configuration since August 2012, when we upgraded to openssl-1.0.1. This included every kernel, hardware, and edge server software combination; and then a careful inspection of the ways in which memory was allocated, to see if any non-long-term memory allocations might border on our secure heap. Most of the configurations were proven safe; but we found one configuration that was not - there was an available memory block in range of the secure key store. This less safe configuration was active on our network for nine days in March 2013 [1] https://blogs.akamai.com/2014/04/heartbleed-update.html

It comes down to intent. There are two distinct ways to evaluate Akamai's patch: 1. Did Akamai release the PoC patch to start a discussion about how to protect private keys and share their work as a starting point for changing the code? If so, their efforts here should be considered in that vein and any criticism should be used simply to guide the development of a usable and functional patch. 2. On the other hand, if they are supplying this code as assurance that customer keys were properly protected against exposure by the Heartbleed bug and that certificate replacement is not needed, the patch and the subsequent criticism should give Akamai customers pause. edit: Akamai acknowledges the bug, and has started rotating all customer SSL keys/certificates, per https://blogs.akamai.com/2014/04/heartbleed-update-v3.html

For background, this came up as Akamai mentioned in their Heartbleed announcement that they didn't think they had any sensitive information[0] disclosed by the bug as they had wrapped OpenSSL's malloc to create two heaps: a secure heap for sensitive information like keys and an ordinary heap: https://blogs.akamai.com/2014/04/heartbleed-update.html It prompted a lot of interest in their solution, which prompted them to release the patch. edit: [0] by "sensitive information" we mean keys, if I understand the implementation correctly, you could still overrun into web server allocation and get back HTTP headers.

Akamai was notified and completed the patch in advance of public disclosure according to their Heartbleed FAQ: https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-systems-patched… This raises the question about whether Amazon/AWS was notified prior to public disclosure.

Apparently Akamai was also given early notice, from the OpenSSL team. https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-systems-patched… I wonder why the various linux distros like debian could not have been notified simultaneously.

I wonder if AWS got an early heads-up from OpenSSL as at least one other major infrastructure provider (Akamai) did: https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-systems-patched…

It may not be a good idea to measure DDoS merely based on the volume. For example, a 100Gbps L7 attack is much harder to mitigate than a 100Gbps L3 attack. [1] Also, some had previously questioned the accuracy of CloudFlare's figures. [2] [1] https://blogs.akamai.com/2013/03/how-big-is-300-gbps-really.html [2] http://www.techweekeurope.co.uk/news/prolexic-ceo-scott-hammack-bigges…