Earlier this week, ForgeRock announced an $88M series D funding, ahead of planned IPO.
I’ve been working with ForgeRock for 7 years, starting the first R&D engineering center in Grenoble, France, and building our Directory Services product. And I’m just amazed by the incredible journey we’ve accomplished since the beginning. I’m just thrilled to be part of this great adventure!
If you want to understand its foundation, take a look at this video with Mike Ellis, CEO and Steve Ferris, SVP Services and Founder.
On March 2nd, ForgeRock will be hosting an UnSummit, a free and open to all event, in Bristol. In an “unconference” format, join us in the ForgeRock’s Bristol offices at Queen’s Square, for a day of discussions, presentations with users, deployers and developers of the ForgeRock Identity Platform.
Top 5 reasons why you (or your team) should join us?
It’s a day for techie’s and nothing like a regular conference
If you’re interested in identity or working on an identity project – it’s a must!
There will be 30+ sessions to choose from during the day
It’s a great opportunity to visit Bristol – one of Britain’s leading “Smart Cities”
Depuis plus d’un an, il y a des réunions mensuelles à Londres pour discuter des technologies autour de l’Identité Numérique, de la gestion des identités et des accès, de la gouvernance, de la sécurité…
According to Corero, the attacks exploited the Lightweight Directory Access Protocol (LDAP), but reading the details of the press release, it appears that the attackers were using Connectionless LDAP services (CLDAP) .
In this case, the attacker sends a simple query to a vulnerable reflector supporting the Connectionless LDAP service (CLDAP) and using address spoofing makes it appear to originate from the intended victim. The CLDAP service responds to the spoofed address, sending unwanted network traffic to the attacker’s intended target.
Connectionless LDAP is a very old technical specification, published in 1995 as RFC 1798. In 2003, this specification was obsoleted by RFC 3352 and moved to historical status. One of the main reason for obsoleting the proposed standard was its insufficient security capabilities.
OpenDJ, the open source LDAP Directory Services in Java, has never supported CLDAP and thus cannot be used in such attack. So, if you are a ForgeRock customer, you should not worry about this kind of attack. But if you’re running a legacy product, that has CLDAP enabled by default, it is probably time to think about moving to a more recent and up to date directory service, such as OpenDJ.