Skip to content

ESET Research investigates the Gamaredon APT group: Cyberespionage aimed at high-profile targets in Ukraine and NATO countries

  • ESET Research examined the operations of Russia-aligned advanced persistent threat (APT) group Gamaredon, which is currently the most engaged APT group in Ukraine.
  • The majority of Gamaredon’s cyberespionage attacks are directed against Ukrainian governmental institutions.
  • ESET saw a few attempts to compromise targets in several NATO countries – namely Bulgaria, Latvia, Lithuania, and Poland – but no successful breaches were observed.
  • Gamaredon notably improved its cyberespionage capabilities, and developed several new tools in PowerShell, with a focus on stealing valuable data – from email clients, instant messaging applications such as Signal and Telegram, and web applications running inside internet browsers.
  • ESET Research discovered PteroBleed, an infostealer that also focuses on stealing data from Ukrainian military system.
BRATISLAVA — September 26, 2024 — ESET Research examined the operations of Gamaredon, a Russia-aligned APT group that has been active since at least 2013 and is currently the most engaged APT group in Ukraine. Gamaredon has been attributed by the Security Service of Ukraine (SSU) to the Russian 18th Center of Information Security of the FSB, operating out of occupied Crimea. ESET believes this group to be collaborating with another threat actor that ESET Research discovered and named InvisiMole. The majority of Gamaredon’s cyberespionage attacks are directed against Ukrainian governmental institutions. However, in April 2022 and February 2023, ESET also saw a few attempts to compromise targets in several NATO countries, namely Bulgaria, Latvia, Lithuania, and Poland, but no successful breaches were observed. Gamaredon is using ever-changing obfuscation tricks and numerous techniques used for bypassing domain-based blocking. These tactics pose a significant challenge to tracking efforts, as they make it harder for systems to automatically detect and block the group’s tools. Nevertheless, during ESET’s investigation, ESET researchers managed to identify and understand these tactics and kept track of Gamaredon’s activities. The group has been methodically deploying its malicious tools against its targets since well before the 2022 invasion began. To compromise new victims, Gamaredon conducts spearphishing campaigns and then uses its custom malware to weaponize Word documents and USB drives accessible to the initial victim, expecting them to be shared with further potential victims. During 2023, Gamaredon notably improved its cyberespionage capabilities, and developed several new tools in PowerShell, with a focus on stealing valuable data – from email clients, instant messaging applications such as Signal and Telegram, and web applications running inside internet browsers.    However, PteroBleed, an infostealer ESET discovered in August 2023, also focuses on stealing data related to a Ukrainian military system – and from the webmail service used by a Ukrainian governmental institution. “Gamaredon, unlike most APT groups, does not try to be stealthy and remain hidden as long as possible by using novel techniques while conducting cyberespionage operations, but rather, the operators are reckless and do not mind being discovered by defenders during their activities. Even though they do not care so much about being noisy, they still put in a lot of effort to avoid being blocked by security products and try very hard to maintain access to compromised systems,” explains ESET researcher Zoltán Rusnák, who investigated Gamaredon. “Typically, Gamaredon attempts to preserve its access by deploying multiple simple downloaders or backdoors simultaneously. The lack of sophistication of Gamaredon tools is compensated by frequent updates and the use of regularly changing obfuscation,” adds Rusnák. “Despite the relative simplicity of its tools, Gamaredon’s aggressive approach and persistence make it a significant threat. Given the ongoing war in the region, we expect Gamaredon to continue in its focus on Ukraine,” he concludes. For a more detailed analysis and technical breakdown of Gamaredon’s tools and activities, check out the latest ESET Research white paper “Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Seven-day moving average of unique machines attacked in Ukraine

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Expanding Innovation: Maximizing Business Offerings With REST-API Integration

In today’s fast-paced tech environment, integrating new solutions swiftly and efficiently can make all the difference in maintaining your competitive advantage. REST-API integration is one such solution that has the potential to accelerate innovation and optimize efficiency by bridging the gap between existing systems and new platforms. At our Platform 2024 event in Las Vegas, Scale Computing’s VP of International Sales, Scott Mann led the “Expanding Innovation: Maximizing Business Offerings With REST-API Integration” panel, showcasing how REST-APIs can transform the way companies manage and deploy a variety of solutions.

REST-APIs provide a standardized way to allow software applications to communicate with one another. They are particularly powerful because they enable different services to work together seamlessly, regardless of the underlying technology. This interconnectivity has become increasingly critical in today’s heterogeneous IT environments, where businesses often need to integrate multiple third-party applications, platforms, and systems.

In addition to Scott, the panel also featured Andy Brauer, CTO at EnchaCloud, a leading cloud service provider based in Pretoria, South Africa as well as Ian Smith, Technical and Alliances Director for EMEA at Scale Computing who also introduced UPONSCALE a self-service cloud platform developed by 365IT, a leading IT solutions provider in France.

Ian explains how the UPONSCALE platform was built on top of the SC//Platform to underpin their own MSP offering and how they leverage REST-APIs to provide users with greater control and flexibility over their virtual environments, helping them to tailor their environments to meet the specific needs of their customers, including:

  • Multi-Tenancy: Users can manage multiple tenants in isolated environments, ensuring data security and customized configurations for each client.
  • Self-Service Portal:The platform allows customers to create and manage their own VMs, set up networks, and even control backup and disaster recovery processes.
  • Built-In Container Management: Utilizing REST-APIs, the platform also integrates container orchestration, allowing businesses to deploy and seamlessly manage Docker containers.

Andy from EnchaCloud also shared insights into “Nav Engine,” a cloud marketplace platform that was designed to meet the needs of SMEs seeking a reliable and customizable cloud solution. Nav Engine was also built atop the SC//Platform and utilizes REST-APIs to deliver a user-friendly, self-service experience.

Andy goes on to detail how automated provisioning via REST-APIs has enabled users of the Nav Engine platform to quickly spin up new products, deploy new VMs, or configure a complex network in a more streamlined and efficient manner. As he noted during the discussion, “everything that we’ve done, we’ve done via APIs and we’ve abstracted the layers of administration and the end user portal so that it makes everything easy to use and fully secured.”

Andy further explains how using REST-APIs in the SC//Platform have enabled Nav Engine to offer a range of new services including white-label options so their customers could customize their cloud services under their own brand as well as the ability to extend their platform to new geographies.

But perhaps the most salient takeaway from both Ian and Andy’s presentations was the importance of listening to customer needs and continuously innovating to meet those demands. By using REST-APIs in conjunction with the SC//Platform, both UPONSCALE and Nav Engine have been able to quickly adapt to changing market conditions so they could deliver more robust, flexible, and user-friendly solutions.

You can watch the entire video on our YouTube channel. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Scale Computing 
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.

Five strong password ideas to boost your security

What is a good password? 

You might think that the answer to this question would be very subjective, but that’s far from the case. In simplest terms, a good password is one that’s difficult to crack. The stronger your password is, the better it works to protect your accounts from hackers and other malicious actors. A strong, reliable password can sometimes take millions of years to crack, which means that the hackers are less likely to even try to gain them.

When you’re thinking of good password ideas, you need to keep the following criteria in mind:

  • The password should be at least 12-15 characters long.

  • It should use a combination of letters, numbers, and special characters. Spaces are also allowed.

  • It should not be a common word, product, character, name, or anything you can easily find in a dictionary.

  • It should be a combination that only you know and others could not easily predict. We’ll cover some creative password ideas shortly.

  • Each password should be unique and you shouldn’t reuse them for several accounts. If a password you use on several platforms is cracked, that puts all of your accounts at risk.

What is considered a weak password?

Weak passwords consist of sequential letters or numbers, are fewer than eight characters long, or use common words and phrases. The most popular passwords are well-known by malicious actors and are usually what they try first.

According to NordPass’ annual top 200 most common passwords list, “123456” and “password” are the most commonly used and vulnerable passwords. Another example of a weak password would be using the name of a fictional character like “Superman,” “Batman,” or “Joker.”

Examples of bad passwords

Here are some more examples of weak, easy-to-crack passwords:

  • 123456789

  • abc123

  • qwerty

  • iloveyou

  • hello

  • computer

  • password123

If you’re wondering whether your passwords might be weak links, check out the list of the top 200 most common passwords. You’ll find even more examples, as well as some fun facts about the most common passwords around the world.

 

The most common password-cracking techniques

Brute-force attack

During a brute-force attack, a malicious actor uses software that tries every possible combination to find the right one. An eight-character password consisting of upper- and lowercase letters, numbers, and special characters can be cracked in just two hours. Good passwords will take months or even years to break through, depending on their uniqueness and complexity.

Dictionary attack

While brute-force attacks try various combinations of special characters, numbers, and letters, a dictionary attack uses a program that goes through a prearranged list of words. Essentially, if your password can be found in a dictionary, specialized software can easily crack it.

Phishing

Phishing is a social engineering method to trick people into revealing their credentials. Phishing attacks often use email services as a medium: hackers send emails pretending to be reputable sources and refer users to fake login pages. A user then inputs their login credentials themselves and inadvertently grants this information to the hackers.

Credential stuffing

Credential stuffing is a popular method for hackers to gain access by collecting usernames and passwords used in previous attacks and trying them on other platforms. This method often proves successful because people tend to reuse the same password for all their accounts.

Keylogging

Keylogging involves a specific type of malware, known as keylogger, infecting the victim’s device. The keylogger can then track the user’s keystrokes and device activity, depending on the software and the device. This can include copied and pasted data, phone calls, location, and screenshots. Using this information, hackers can easily access passwords and other sensitive information, allowing them to launch further attacks on the individual or data from their place of work.

How to create a strong password

  • The longer your password is, the better. Many websites ask you to create eight-character passwords, but we recommend going for at least 15 characters.

  • Avoid ties to your personal information, such as your name, surname, address, or date of birth.

  • Use a combination of numbers, symbols, and upper- and lowercase letters in random order.

  • Don’t use sequential letters and numbers.

  • Avoid substitution: “kangaroo” and “k@ng@r00” are both equally weak passwords, and a brute-force attack can easily crack them.

  • Don’t reuse the same password for multiple accounts.

With our free password security tool, you can check your password strength and if it has been exposed in any data breaches. You can also try the Password Health feature with NordPass Premium. It scans all passwords that you’ve saved in your Vault and checks for vulnerabilities.

Top 5 strong password ideas

Coming up with a strong and unique password can be a challenge. To make this process easier for you, we’ve gathered some examples that will help protect your data and accounts from being breached and taken over. We’ve also included some formulas and passphrase examples that you can try yourself. However, we highly recommend you don’t use the example passwords for your accounts.

1. Shorten each word

Think of a phrase and remove the first three letters of each word (in some cases, that might mean deleting full words, but that’s fine):

“Laptop running free in the jungle” -> “top ning e gle”

Sounds like gibberish? That’s exactly what we want. Just don’t forget to add special characters and numbers to make it more complicated. It would take 94,000 years to crack this password.

2. Create your own formula

Create a formula that will help you remember the password. For example, you can take a phrase and replace every letter with the next one in the alphabet:

“Cucumbers are tasty” -> “dvdvncfst bsf ubtuz”

Another clever way of creating strong passwords is to turn song lyrics into acronyms. This means using only the first letter of each line of your favorite song.

So, “Shine on you crazy diamond” by Pink Floyd becomes “rsnsybccystswrcc.”

The time needed to crack this password is 746 million years.

3. Play with the vowels

This one is much easier to implement and memorize: take a random nonsensical phrase and replace one vowel with another (for example, “a” with “e”):

“A car is floating in a pan” -> “e cer is floeting in e pen”

Don’t forget – spaces are allowed in passwords, and we highly encourage you to use them. The combination of having spaces and switching the vowels around means the above password would take 583 million trillion years to crack.

4. Mix the codes of your favorite countries

This one is quite fun and easy to memorize. You will always generate good passwords with this method. Simply make a list of the ISO codes of your favorite countries and put them together:

“Mexico, Ireland, France, Germany, Japan” -> “mex irl fra deu jpn”

You wouldn’t think so, but a hacker would require a staggering six thousand trillion years to crack this password!

If you want to spice things up and make them even more difficult to crack, you can also add each country’s calling code:

“mex54 irl353 fra33 deu49 jpn81”

Such a password would take 12 decillion years years to crack. How impressive is that?

5. Use a password manager

If creating and remembering random phrases for all your accounts seems too complicated, you can use a password manager, such as NordPass. It’s an easy-to-use app that lets you generate strong, unique passwords and securely store them in an encrypted Vault. You can also easily use NordPass to autofill online forms and fields.

You can add as many passwords as you need and access them from any device. This way, you can get the best of both worlds by combining your creative password ideas with one-of-a-kind secure ones created by the password manager for each account without the risk of forgetting them. You can use a special code and get an additional month of NordPass Premium for free when you purchase a two-year plan.

Additional tips

Here are some more tips to keep in mind when you’re looking for good password ideas:

  • In order to protect your data, remember that passwords must be difficult to predict. Including special characters and spaces increases the time it takes for your password to be cracked.

  • Take your phone security into consideration. According to research, pattern locks are successfully replicated around 64% of the time. Instead, set up a PIN or use our guide to generate some strong phone password ideas.

  • Don’t forget to implement new password ideas for work. Don’t reuse your personal passwords because if they ever get breached, your work accounts could be in danger, too.

  • Always use multi-factor authentication (MFA). Even if your password is definitively strong, accidents can happen and your first line of defense might be breached. Using MFA means that no one can access your accounts without accessing your authentication device. NordPass uses multi-factor authentication to add an additional layer of security to your password vault.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Bridging IT and OT Security: NDR’s Role in the Protection of Industrial Assets

The convergence of Information Technology (IT) and Operational Technology (OT) is transforming industries. While this integration drives operational efficiency and faster decision-making, it also creates new cybersecurity challenges. GREYCORTEX Mendel offers a unified way to monitor and protect both your IT and OT environments.

As digital transformation continues, IT systems, like corporate networks and databases, are increasingly linked with OT systems, such as industrial control systems and sensors. This connection improves data sharing and process control but demands a unified approach to securing both technologies.

New cybersecurity threats are constantly emerging as the Internet of Things (IoT) and automation continue to grow. One of the biggest challenges is ensuring seamless communication between IT and OT teams, which often have distinct goals and methods. Addressing these challenges requires identifying critical assets and implementing tailored security measures.

The Core Security Requirement

A fundamental security requirement in any company is identifying and classifying assets. Understanding the value and strategic importance of each asset allows for the appropriate level of protection. Tools that enable effective monitoring and protection of both industrial and digital assets are essential in this context.

Key Differences Between IT and OT Environments

IT and OT environments differ in focus, asset life cycles, and the personnel managing them. While IT prioritizes data processing, business operations, and frequent updates, OT centers on controlling physical processes and maintaining long-term operational stability. OT systems often remain in place for decades without major updates, creating potential security gaps.

IT and OT teams also have different expertise. IT teams focus on data confidentiality and cybersecurity, while OT teams prioritize the safe operation of industrial assets, often resisting upgrades to avoid disruptions. 

Another key difference lies in the communication protocols used in each environment.

So how do you protect both environments with one monitoring solution?

NDR’s Role in Protecting IT and OT

NDR solutions are pivotal in safeguarding industrial environments, providing visibility into both your IT and OT networks. A prime example is GREYCORTEX Mendel, which passively monitors traffic across both networks to detect anomalies without interfering with system operations—a critical requirement for industrial settings.

Mendel correlates data from various sources to identify threats early, allowing analysts to investigate security events and uncover connections between them. While defining processes and security policies is critical, verifying compliance is equally important. Mendel continuously monitors these processes and notifies you about any non-compliance. Any incidents detected can also be easily exported into clear reports.

Bridging the IT-OT Divide

Better infrastructure visibility, deeper threat understanding, stronger protection of both digital and industrial assets—these are some of the key benefits that NDR solutions bring.

Mendel facilitates cooperation between your IT and OT teams. By integrating with the MITRE ATT&CK® Framework, Mendel creates a common language for analyzing threats, helping both teams collaborate more effectively.

Additionally, Mendel allows you to customize event categorization based on team needs, ensuring IT and OT professionals see the information that matters most to them—within the same solution, but with their own tailored interface.

The Future of Industrial Cybersecurity

As cyber threats evolve, the convergence of IT and OT systems requires tools that can adapt and offer comprehensive protection. GREYCORTEX Mendel meets these needs by learning and responding to new attack types, ensuring the security of both your digital and industrial assets. The continued integration of IT and OT networks necessitates a unified monitoring and response approach, where NDR solutions are central. By leveraging tools like Mendel, organizations can strengthen their cybersecurity posture, ensuring resilience and continuity in an increasingly interconnected digital landscape.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Apache Tomcat Security Best Practices

In this blog, we look at eight ways to improve your Apache Tomcat security hardening, ranging from basic best practices like not running your Tomcat as the root user, to more advanced tips like using realms to control resource access. At the end of the blog, we’ll wrap up with some final thoughts about how to secure Tomcat and then link to some related resources you should check out. Let’s dive in!

Editor’s Note: This blog was originally published on December 29, 2020 and was revised and updated with new content on September 3, 2024. 

Why You Need to Secure Tomcat

Apache Tomcat is a robust application server that includes many features available right out of the box. However, just because these features and settings are available right away doesn’t mean that your Tomcat server is ready for production. Before you go to production, you need to perform thorough tuning and security hardening to ensure your Tomcat server is secure.

Back to top

How to Keep Your Tomcat Secure: 8 Tomcat Security Hardening Tips 

There are many ways to improve Apache Tomcat security, and this blog is no replacement for a thorough dive into the possible ways in which you can do so. However, the tips below are a good starting point for people interested in hardening their Tomcat server deployment. 

1. Don’t Run Tomcat as the Root User

The root or administrator account has access to everything in the file system. It is best practice to create a separate account that has read, write, and execute access to the Tomcat installation directory and specific folders the application needs access to. Grant this account minimum operating system permissions.  

Vulnerabilities are exposed periodically with Tomcat releases and updates to your application and any frameworks your application uses. Fixes for these vulnerabilities are provided rapidly by the community, but it can give an attacker a small window of time to do something malicious. 

2. Default Samples and Test Applications

There are four web applications that come out of the box with Apache Tomcat:

  • docs: This is the documentation for Apache Tomcat. This is a duplicate of the documentation you will find on Apache Tomcat’s website.
  • examples: This is servlet, JSP, and WebSocket examples along with the source code that runs those examples.
  • manager: This is the Tomcat Web Application Manager application that enables you to administer the application server via a user interface.  You need the role “manager-gui” to access this application.
  • host-manager: This is the Tomcat Virtual Host Manager is a web application that allows users to manage virtual hosts.  Virtual hosts allow you to deploy multiple websites (or domains) in single instance of a Tomcat server.  The “admin-gui” role is required to access this application.

You can remove these four applications and still have a fully functional application server, but by default they are only accessible by the machine they are running on. You can change this behavior in each application’s META-INF/context.xml (more on this later). 

The examples application does have some vulnerabilities (session manipulation) and should be removed from any production environment. The docs application should be removed because it identifies to a potential attacker what application server and version you are running. 

The manager and host-manager applications can remain on the Tomcat instance, but these applications should be locked down by setting the proper permissions using roles in tomcat-users.xml and setting a very strict Remote Host or CIDR Valve in the applications META-INF/context.xml file. 

3. Set Your Tomcat Permissions Carefully

The SecurityManager in Jakarta EE 11 has finally been removed, so you will not find a conf/catalina.policy for Apache Tomcat versions 11 and greater. This file controlled an application’s permissions to internal Catalina jars and classes. 

If you are running a version of Tomcat prior to version 11, then a review of this file would be worthwhile. Most of our customers do not touch this file, and fortunately the format of this policy file is self-documenting and easy to read. If you compare the catalina.policy with the out of the box unmodified file, then you can identify any changes easily.

4. Upgrade to Tomcat 11

Apache Tomcat 11 (currently in beta but we expect the GA release any day now) includes security enhancements and implements six specifications of Jakarta EE 11, which also includes additional enhancements to Tomcat including:

  • Removing sensitive HTTP headers from TRACE requests
  • Mandatory HTTPS support
  • Updated HTTP RFC references to the latest versions
  • Examples and documentation web applications are only accessible from localhost by default as this might expose a cookie to an attacker.
  • rejectIllegalHeader hard-code to true: We can either ignore illegal HTTP headers or send a 40x.
  • allowHostHeaderMismatch hard-coded to false: issues in reverse proxy situations where header is different from the URL.
  • Align AJP connector handling of invalid HTTP headers with HTTP connector.
  • Added RateLimitFilter: Prevents Denial of Service (DoS) and brute force attacks by limiting the number of requests that are allowed from a single IP address within a time window.
  • Log TLS certificate information on startup. 
  • Dedicated loggers for detailed TLS configuration information.
  • Added TLSCertificateReloadListener: Monitors certificate expirations and trigger automatic reloading of the TLS configuration a set number of days before the TLS certificate expires.  Tomcat restart required or JMX command to reload it.  It periodically checks on a frequency you define.  Shows how close that certificate is from expiring.  If you do not update it, then it will start logging warnings.

5. Enable TLS

A critical step in hardening your configuration is setting up end-to-end encryption between the browser and the application server. The first step is creating a keystore using the JDK’s keytool:

keytool -genkey -alias openlogic -keyalg RSA -keysize 2048 -keystore keystore.jks

keytool will ask a series of questions. The most important question is “What is your first and last name?” This should be set to the domain name the server will sit behind and not your first and last name. The question should be reworded to: “What is your CN (Common Name)?” This means the domain which your server will be known by. The output of the keytool should look like the following:

Enter keystore password: changeit

Re-enter new password: changeit

Enter the distinguished name. Provide a single dot (.) to leave a sub-component empty or press ENTER to use the default value in braces.

What is your first and last name?

  [Unknown]: openlogic.com

What is the name of your organizational unit?

  [Unknown]: OpenLogic

What is the name of your organization?

  [Unknown]: Perforce

What is the name of your City or Locality?

  [Unknown]: Minneapolis

What is the name of your State or Province?

  [Unknown]: MN

What is the two-letter country code for this unit?

  [Unknown]: US

Is CN=openlogic.com, OU=OpenLogic, O=Perforce, L=Minneapolis, ST=MN, C=US correct?

  [no]: yes

Generating 2,048 bit RSA key pair and self-signed certificate (SHA384withRSA) with a validity of 90 days

     for: CN=openlogic.com, OU=OpenLogic, O=Perforce, L=Minneapolis, ST=MN, C=US

This command will create a keystore.jks in the directory keytool was run from. 

A certificate signing request (CSR) will need to be generated from the keystore.jks and sent to a trusted certificate authority if you want the certificate to be trusted by the browser. This step is optional if you are testing.  The traffic will still be encrypted, but you will receive a “not trusted” message from the browser. 

To generate a CSR run: 

keytool -genkey -alias openlogic -keyalg RSA -file openlogic.csr -keystore keystore.jks

Then send openlogic.csr to a trusted certificate authority for signing. We will not cover the steps here, but the certificate authority will send you back a certificate to import into your keystore.jks. 

There are certificate authorities which will send you a free 90-day signed certificate for free as long as you are the domain owner. They will require you to import their root, intermediate, and your signed domain certificate into keystore.jks. 

First import the root certificate:

keytool -importcert -alias root -file root.cer -keystore keystore.jks

Then import the intermediate certificate:

keytool -importcert -alias intermediate -file intermediate.cer -keystore keystore.jks

Last, import your signed domain certificate:

keytool -importcert -alias openlogic -file openlogic.cer -keystore keystore.jks 

You cannot only import your signed certificate because the browser also needs the root and any intermediate certificates to trust the domain certificate.

The next step is configuring your server.xml to listen on a trusted secure port by presenting a valid certificate and end-to-end encryption. The syntax assumes Tomcat 9.0+; versions of Tomcat prior to 9.0 require a different syntax which we will not cover here.

Create the following snippet of XML in Tomcat’s conf/server.xml:

…

<Server port=”8005″ shutdown=”SHUTDOWN”>

…

  <Service name=”Catalina”>

… 

    <Connector port=”8443″
protocol=”org.apache.coyote.http11.Http11NioProtocol”

               maxThreads=”150″ SSLEnabled=”true”>

        <UpgradeProtocol className=”org.apache.coyote.http2.Http2Protocol” />

        <SSLHostConfig>

            <Certificate certificateKeystoreFile=”conf/keystore.jks”

                 certificateKeystorePassword=”changeit”

                  type=”RSA”

             />

        </SSLHostConfig>

    </Connector>

…

  </Service>

</Server>

This assumes the keystore.jks is in Tomcat’s conf directory. 

The configuration changes up to this point do not force plain-text port 8080 to redirect to 8443. To enable this functionality, modify Tomcat’s conf/web.xml by adding the following XML snippet:

<web-app…>

…

    <security-constraint>

      <web-resource-collection>

        <web-resource-name>everything</web-resource-name>

       <url-pattern>/*</url-pattern>

      </web-resource-collection>

      <user-data-constraint>

       <transport-guarantee>CONFIDENTIAL</transport-guarantee>

      </user-data-constraint>

    </security-constraint>

</web-app>

By modifying Tomcat’s conf/web.xml with this change, this tells the application server that you want all unencrypted traffic to be handled by an encrypted port.  Restart Tomcat for the configuration changes to take effect. Then go to http://localhost:8080.

If you did not send the CSR from the earlier step to a trusted certificate authority, then you may receive some warnings from the browser. Tomcat will then redirect the browser to https://localhost:8443.

The server I tested with is Apache Tomcat 11 with OpenJDK 21.0.4. After running a protocol test, the server was found to support TLS 1.2 and 1.3 with no support of outdated protocols SSLv3, TLS v1.0 and 1.1 (which is desired due to vulnerabilities).

6. Log Your Network Traffic

To enable logging of network traffic in Tomcat, use the AccessLogValve component. This can be configured on a host, engine, or context basis and will create a standard web server log file for traffic to any resources associated with it. 

The Access Log Valve supports a variety of attributes to control the output of the valve. This valve is enabled by default in server.xml:

 

…

      <Host name=”localhost”…

<Valve className=”org.apache.catalina.valves.AccessLogValve”        directory=”logs”prefix=”localhost_access_log” suffix=”.txt”

        pattern=”%h %l %u %t &quot;%r&quot; %s %b” />

      </Host>

…

This valve creates a daily rotating localhost_access_log.yyyy-mm-dd.txt file in Tomcat’s log directory. With the pattern configured in the statement above, the valve will print the remote host (%h), username (%l), date and time (%t), first line of the request (%r), HTTP status of the response (%s), and bytes sent (%b) of every request. 

The following output results when the root page is accessed:

35.139.184.195 – – [30/Jul/2024:21:05:18 +0000] “GET / HTTP/2.0” 200 11223

The pattern can be customized in numerous permutations; see Tomcat 11 documentation for details.

Be careful in using this valve as it can put write pressure on the disk if the application server is busy.

7. Limit Access to the Tomcat Manager App

The Tomcat Manager application is a built-in webapp used to manage Tomcat instances, application deployment and other various settings. By default, the Manager application can only be accessed from the machine it is running on or an address in the 127.0.0.0 subnet range using IPv4 or the IPv6 loopback (::1 or 0:0:0:0:0:0:0:1), and this is configured in the META-INF/context.xml using the Remote Address Valve:

  <Valve  className=”org.apache.catalina.valves.RemoteAddrValve”

        allow=”127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1″ />

 

If there are specific IP addresses you want to allow, then use the following syntax: 

  <Valve className=”org.apache.catalina.valves.RemoteAddrValve”

       allow=”192.168.1.2|192.168.1.3″ deny=”” />

This configuration allows access into the application if your IP address is either 192.168.1.2 or 192.168.1.3.

The Remote Address Valve also has a deny attribute which is used if there are any specific addresses separated by commas that you want to blacklist. 

This valve can be used in any application that is deployed on Tomcat. 

If a range of addresses is preferred to limit access, then use the Remote CIDR Valve in META-INF/context.xml:

  <Valve className=”org.apache.catalina.valves.RemoteCIDRValve”

         allow=”127.0.0.1, 192.168.1.0/24″ deny=”” />

This allows access from the loopback address as well as any addresses in the 192.168.1.0 subnet range.

8. Use Realms to Control Resource Access

Realms are another method of controlling authentication and authorization to resources in Tomcat. A realm is a collection of users and roles that are assigned access to a given application or group of applications and the privileges they have within the application once logged in. 

There are four built-in manager roles:

  • manager-gui: HTML GUI and the status pages
  • manager-script: HTTP API and the status pages
  • manager-jmx: JMX proxy and the status pages
  • manager-status: Status pages only

Realms are pluggable. Realms can be configured to connect to a relational database, LDAP, JAAS, a global JNDI resource (such as an XML file), or a combination of realms. 

The LockOut Realm is the default in Tomcat which uses the conf/tomcat-users.xml file to control authentication and authorization.The role and users are by default commented out, but a simple example with one user with the manager-gui role would look like the following:

<tomcat-users>

  <role rolename=”manager-gui”/>

  <user username=”tomcat” password=”changeme” roles=”manager-gui”/>

</tomcat-users>

The LockOut realm by default will cause a user to be locked out for five minutes if the password is guessed incorrectly five times which will be displayed in the catalina.out log file:

05-Aug-2024 21:29:39.980 WARNING [https-jsse-nio-8443-exec-4] org.apache.catalina.realm.LockOutRealm.filterLockedAccounts An attempt was made to authenticate the locked user [tomcat] 

In addition, the plain-text passwords in tomcat-users.xml can be encrypted.  In server.xml, find the UserDatabaseRealm and change it to:

<Realm className=”org.apache.catalina.realm.LockOutRealm”>

  <Realm className=”org.apache.catalina.realm.UserDatabaseRealm”

    resourceName=”UserDatabase”>

<CredentialHandler className=
“org.apache.cataline.realm.MessageDigestCredentialHandler” algorithm=”SHA-256″/>

   </Realm>

Any changes to server.xml require a server restart. Modifications to tomcat-users.xml do not necessitate a server restart as this file is monitored for changes.

Generate a hash from a plain-text password:

${TOMCAT_HOME}/bin/digest.sh -a SHA-256 -h org.apache.catalina.realm.MessageDigestCredentialHandler changeme

The “-a” is for the algorithm to be used when encrypting the password.  Any algorithm available to the JDK can be used such as SHA-512.

The hash of the password will be displayed after the colon:

changeme:5d56e72f51f7ec5a0bd724e026fa2856ce7f8821358c0f854b3 e18bf20780960$1$5979cdb240050fbb72ad6ed1f69ac8d161634ea91e3f f52e83176fb44fc1562f

Place the hash in the tomcat-users.xml for the particular user:

<tomcat-users>

  <role rolename=”manager-gui”/>

  <user username=”tomcat”     password=”5d56e72f51f7ec5a0bd724e026fa2856ce7f8821358c0f854b 3e18bf20780960$1$5979cdb240050fbb72ad6ed1f69ac8d161634ea91e3 ff52e83176fb44fc1562f” roles=”manager-gui”/>

</tomcat-users>

Keep in mind that all passwords must be hashed in tomcat-users.xml if the MessageDigestCredentialHandler is used.

Tomcat should detect the file changed without a restart:

05-Aug-2024 21:26:22.987 INFO [Catalina-utility-2] org.apache.catalina.users.MemoryUserDatabase.backgroundProcess Reloading memory user database [UserDatabase] from updated source [file:/home/rocky/apache-tomcat-11.0.0/conf/tomcat-users.xml]

Lastly, file access to Tomcat’s conf should be limited to the account running Tomcat.

Back to top

Final Thoughts

While these are some of the many ways you can secure Tomcat, there are still plenty of other things out there that can be done which go beyond the scope of just a blog article. We encourage all our Tomcat users to take a deep dive approach to Tomcat security, utilizing all the resources out there.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Perforce
The best run DevOps teams in the world choose Perforce. Perforce products are purpose-built to develop, build and maintain high-stakes applications. Companies can finally manage complexity, achieve speed without compromise, improve security and compliance, and run their DevOps toolchains with full integrity. With a global footprint spanning more than 80 countries and including over 75% of the Fortune 100, Perforce is trusted by the world’s leading brands to deliver solutions to even the toughest challenges. Accelerate technology delivery, with no shortcuts.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×