Cyber Security Cloud, Inc. announces the detection report of attacks targeting web applications for 2021 (January 1 to December 31, 2021). In addition, this data is Cloud-based WAF that visualizes and blocks cyber-attacks on the website provided by our company, "Shadankun" and AWS WAF, Azure WAF, Google Cloud Armor automated operation service "WafCharm". Aggregate, analyze and calculate the attack logs observed in .

■Survey overview
・ Survey period: January 1 to December 31, 2021
・Survey target: User accounts using “Shadankun” and “WafCharm”
・Investigation method: Analysis of attack logs observed by “Shadankun” and “WafCharm”

■ Cyber attack detection status in 2021
~Detected 42,000 attacks per year per host~

The total number of cyber-attacks detected in 2021 (January 1st to December 31st) was 415,463,802. This is an increase compared to the total number of attack detections in 2020 (334,932,032), but per host*, it remains flat at approximately 42,000 in 2021 and approximately 43,000 in 2020.
* Estimated using the total number of protected hosts for Shadankun" (Web type: number of FQDNs, server type: number of IPs) and the number of protected hosts for "WafCharm" (WebACL) as the denominator.

In general, host countries in the years when the Olympics and Paralympics are held tend to see a marked increase in cyberattacks before and after the games are held. However, regarding this tournament, fortunately, there have been no observations or reports of conspicuous damage caused by large-scale attacks related to this matter from the parties concerned, the police, NISC, etc.
However, it is clear that the number of attacks targeting web applications itself was on the rise. Looking back at the annual trend by quarter, in the first half of January to June 2021, the number of attacks per host was 10,828 to 11,396, while the number of attacks in the third quarter from July to September was It decreased to about 9,573, and the total number of attack detections during the period decreased as well. However, in the fourth quarter (October to December), approximately 10,615 attacks were detected per host, and the total number of attack detections was 113,397,217, which is the highest number by quarter in 2021. It is presumed that this is not entirely unrelated to the fact that serious vulnerabilities in Movable Type and Apache Log4j, which will be described later, were announced in the fourth quarter of 2021 and are still in the midst of it.

In addition, looking at the number of attack traffic to web applications detected by our company in 2021 by attack source country, the top number will be from Japan, followed by the United States, Germany, Canada, and China at the same rate. I'm here.

■ Main attack types
- The total number has increased since last year, but the trend remains the same -

Looking at the attack status of the main attack types during this survey period, although the overall total number has increased as mentioned above, the main trend has not changed much from 2020. The most common type of attack was the "Blacklisted user agent," which is an attack by a bot using a vulnerability scanning tool, accounting for approximately 37.6% of the total, followed by the "Web attack," which is an attack against vulnerabilities in the software that makes up the web server. ” continues at about 27.5%. And the third most common was "Web scan", which is a "sign of attack" such as searching and investigating the target of attack and searching for vulnerabilities in simple attacks that are performed at random. 11.1% → 14.8%, the number of cases increased from 37,192,991 → 61,438,071, not a little from 2020. In addition, regarding the 7th most common "Traversal attack" that illegally accesses files on the web server, the number of cases has increased from 9th in 2020.
The number of DoS attacks increased from 2,851,256 to 6,509,911, and the number of DoS attacks in 9th place this time increased from 993,900 to 3,622,036 compared to 2020 (10th), showing a noticeable increase in the number of cases compared to other attacks.

Regarding the number of attacks by attack type in 2020, we reported that it was found that the threat of "web attacks" increased with the spread of the new coronavirus infection, and this trend will continue in 2021 as well. . In addition to the increase in the total number of attacks detected, there has also been a significant increase in the total number of detections of "Web scans", which are signs of attacks. You can guess.

■ Attack status for major vulnerabilities
~ The most serious vulnerability in the last few years was also discovered ~

－Attacks targeting vulnerabilities in Movable Type
Regarding the remotely exploitable vulnerability (CVE-2021-20837) in Movable Type's XMLRPC API published on October 20, 2021, if you receive a special request for the purpose of exploiting this vulnerability. , OS commands may be executed and cause various damages. Versions that may be affected by this vulnerability are as follows:
- Versions before Movable Type 7 r.5003
- Versions before Movable Type Advanced 7 r.5003
- Versions before Movable Type 6.8.3
- Versions before Movable Type Advanced 6.8.3
- Versions before Movable Type Premium 1.47
- Versions before Movable Type Premium Advanced 1.47
According to the developer, Movable Type 4.0 and above (including Advanced and Premium), including versions that are no longer supported, are affected.
Regarding this vulnerability, since November 10, 2021, we have actually detected communications that are assumed to be the same attack. In addition, from the second half of November to the year-end and New Year holidays of the same year, we detected communications that were assumed to be attacks on a large number of hosts. If the vulnerable Movable Type continues to operate in a state where it can be accessed from the outside, it may suffer various damages in the future. We recommend taking measures such as investigating the possibility of being affected by the attack, and once again call attention to it.

- Attacks targeting the RCE vulnerability in Apache Log4j2
On December 9, 2021, the existence of a remotely exploitable vulnerability (CVE-2021-44228) was announced in Apache Log4j, a popular Java log output library. Since it is extremely important to record "logs = history and records" in a system, log4j is widely used in systems that use Java. The value of the vulnerability threat index (CVSS 3.0) announced this time is the highest value "10.0", and a risk that affects such an easy and wide range is an extremely dangerous vulnerability that you see only once in several years. can be called gender. From December 13th to the present, we have also continuously detected communications presumed to be attacks. The sharp increase in the number of attacks on December 30th seems to be a typical example of an increase in attacks aimed at year-end holidays.

The vulnerability is an arbitrary code execution vulnerability in the Java Naming and Directory Interface (JNDI) functionality of Apache Log4j, where a remote party sends a "crafted string" that Log4j logs. could execute arbitrary code. Being able to execute arbitrary code is very close to being able to do anything, and it's one of the most serious vulnerabilities in years.
After that, in this case, as of January 24, 2022, CVE-2021-45046 (update (2.15.0) vulnerability that allows arbitrary code execution under certain conditions due to insufficient fixes), CVE-2021-45105 (Denial of Service Vulnerability Affected Only Certain Configurations in Log4j Due to Unprotected Self-Referencing Uncontrolled Recursion), CVE-2021-44832 (JNDI Functionality Causes Certain Uncontrolled Recursion) Multiple vulnerabilities such as remote arbitrary code execution vulnerability when using data sources) have been added, and updating to the following versions is required to address all vulnerabilities. .
[Latest modified version]
- Apache Log4j 2.17.1 (for Java 8+ users)
- Apache Log4j 2.12.4 (for Java 7 users)
- Apache Log4j 2.3.2 (for Java 6 users)
In the same way, we recommend measures such as investigating the possibility that you have already been affected by attacks as well as countermeasures against vulnerabilities, and once again call attention to it.

■Finally
〜Methods are diversifying and attacks are becoming as a service〜

In 2022, with the help of the continuing corona disaster, telework is generally deeply penetrated and a constant connection between the internal network and the outside is a prerequisite for business execution, but trends so far and the current Omicron stock It is expected that the style of "telework" will basically become normal in the future, and it will be permanently established as a work style.
In addition, in a situation where not only the threat of targeted attacks but also ransomware is becoming more and more serious, attackers can easily and more automatically exploit the black market even if they do not have special knowledge these days. It has become easier to launch attacks targeting specific targets (e.g., the shift to SaaS for targeted attacks, the rise of Ransomware as a Service = RaaS, etc.). To put it bluntly, in an era when there are quite a few services that even elementary school students can use (as long as they can speak English to some extent), attackers are also becoming “DX”.

Perhaps because of this situation, interest in zero trust (= no one believes in it) is growing. Instead of always granting authority based on job title, the basics of Zero Trust is to "give the minimum necessary authority only to the necessary people for the necessary time, and immediately revoke the authority that has been granted". However, considering usability and operational aspects, there may still be cases where it is not possible to fully implement the concept depending on the organization. If you do not implement and operate it, you cannot deny the possibility that you will fall into an unexpected pitfall just by introducing it. In addition, it can be said that the lack of security personnel with the knowledge and experience to do so is a point of concern.
"Zero Trust" is currently in a transitional period, and I think it will take a little more time for it to become a reality.

For the time being, many attackers will first target vulnerabilities, so we will "division of labor" on the premise of periodically investigating and confirming "where we are vulnerable". First, introduce a "security system that does not rely on humans" for the parts that can be automated by the system (conversely, the work that cannot be wiped out by human hands). Second, we will use the system (log management, etc.) for the parts that are difficult to deal with alone, while maintaining a balance between IT convenience and security strength through human security (continuing to improve literacy through steady education and enlightenment). keep. By using both of them together, I think it is more effective at the moment to implement strong security measures while minimizing business productivity.

Although "guaranteeing a certain level of security strength" is a major premise, it is more important to ensure strong security and "give a sense of security both inside and outside the company" and to realize "ease of work and satisfaction" for members. Isn't it also important to maintain a certain balance without being too biased to one side?

■Comment from Yoji Watanabe Representative Director, CTO
Ransomware has become a global topic in 2021, and it has become known to the world that attackers not only threaten data recovery, but also triple and quadruple threats. Triple and quadruple threats and some of these attacks threaten to launch DoS/DDoS attacks on websites, and ransomware-only defenses are no longer able to control the impact on businesses.

After the fall of 2021, the vulnerabilities of Movable Type and Log4J, which are picked up in this report, will become a big topic, and even in 2022, the situation will not be completely converged.
When security patches are released, the attack methods become clearer and are incorporated into tools. Companies that are busy with defense are required to quickly grasp the situation and take countermeasures. I think it's the reality that it's going to be a slow response in comparison.

In addition to continuous system health check measures, such as daily identification of vulnerabilities and countermeasures when vulnerabilities are discovered, defense rules are used in the sense of providing a certain level of protection even when the system cannot be renewed. can be used quickly, and the introduction of a cloud-based WAF is a highly effective measure, as the defense rules are continuously updated against sophisticated attack methods that have been recognized even after the vulnerability has been disclosed. It can be said.

[About Cyber Security Cloud, Inc.]
Company name: Cyber Security Cloud, Inc.
Location: VORT Ebisu maxim 3F, 3-9-19 Higashi, Shibuya-ku, Tokyo 150-0011
Representative: Toshihiro Koike Representative Director, President and CEO
Established: August 2010
URL: https://www.cscloud.co.jp/