Introducing The BitNinja Server Security Modules

A study done by BullGuard found that 60% of SMB owners believe their company is unlikely be targeted by hackers. Are you convinced?

It is far from the truth. To show you why cybersecurity is so important, I could give you a thousand statistics. Let’s look at the top three items on my list.

1. Hackers Attack Every 39 Seconds. ( University of Maryland).
   The computers in the study were being attacked 244 times per day. It was 2007… I can assure you that this number has not decreased since then.
2. 60% of SMBs close within six months of a major attack. ( National Cyber Security Alliance).
3. SMBs are the target of 43% cyberattacks. ( Verizon).

It is time to seriously consider cybersecurity. Cybersecurity should be a priority for your business. It is essential!

We have the solution! It’s called BitNinja Security.

It is a award-winning, all in one, simple-to-use cybersecurity tool that hosting providers can benefit from. It can protect you against all types of cyberattacks thanks to its many modules.

Let’s take a look at BitNinja and how it differs from other cybersecurity tools.

Anti-Malware vs. Backdoors

Backdoors are often installed as malware. They allow access to the server so that the attacker can take advantage of the server’s resources. To prevent hackers from creating additional backdoors, it is important to immediately remove and block the infected malware files.

Hackers are always evolving their techniques and have been using malware disguised as regular system files to infect computers. These new threats are not detected by traditional malware detection methods. We developed a resource-friendly method that detects any malware upload attempt, even if it is obfuscated. It also has a low false-positive rate. Patent pending for the unique technology behind the new Malware Detection Module.

BitNinja Malware Detection Module detects infected files, and then places them in quarantine to prevent further damage to your server.

What makes it different from other Anti-Malware products?

• STRUCTURE ANALYSIS
  BitNinja Anti-Malware module integrates the most advanced methods of analysis.
• OBFUSCATED CODE IDENTIFICATION
  BitNinja analyzes the code structure to identify hidden malware.
• RESOURCE-FRIENDLY
  BitNinja employs two-level caching. It stores the results from the malware analysis in memory as well as a database cache. BitNinja also employs the most recent techniques to decrease resource consumption: Aho-Corascik algorithms and audit file monitoring.
• QUICK FULL SCAN
  The full scan runs extremely fast when a new pattern has been added to the Anti-Malware Module. This saves time and helps to locate emerging threats quickly.
• DEFENSE ROBOT
  The BitNinja Defense Robot automatically detects the source of infection. The IP address of the attacker will be blocked and the abused domain/URI/URI will automatically be “honeypotified”.
• AUTO-HONEYPOT SYSTEM
  The “honeypotify function” will create a honeypot to capture any attacks. A web honeypot can be used to replace the backdoor.
• CROWD-SOURCED DATABASE FOR MALWARE
  Power is in the numbers! This allows BitNinja servers to be protected against zero-day attack much sooner.
• CUSTOM MALWARE SIGNNATURES
  You can also add custom malware patterns into your database. The changes you make to a server will also be made to all servers.

BitNinja’s Anti-Malware Module was named the Cyber Security Excellence Awards winner in the Anti Malware of the year category (2021). It was also a finalist in The Cloud Awards (2020-21), in Security Innovation of the Years category, and a finalist in the Cyber Security Awards (2020-21), in the Innovative Product of the YEAR category.

WAF vs. Web Attacks

Server security is a special concern for shared hosting companies. It can be difficult to protect your servers from malicious requests, even though there are hundreds of thousands of domains.

Web Application Firewalls (WAF) are the best way to prevent website cyberattacks. The BitNinja WAF2.0 works between your web server and visitors’ web browsers. It is a very fast reverse proxy that filters all requests to the web and rejects any attacks.

BitNinja WAF 2.0 makes managing all firewall settings easy. You can also set filter levels by domain. Domain-based patterns allow you to change the strictness level per domain or URL. This will prevent malicious traffic from reaching your hosted sites and allows legitimate traffic. This feature is exclusive to BitNinja, and it makes managing shared servers much easier.

We are always adding new WAF rules and patching CMS vulnerabilities to keep you safe. You can also get automated false-positive reporting that allows you to fine-tune your settings if necessary. We guarantee a low false positive rate with pre-defined rulesets. To learn more about the damages of web attacks, learn more here.

What makes it different than other WAF solutions.

• DOMAIN PATTERNS
  You can also set strictness and filtration levels for each domain, in addition to the server-based settings.
• CONSTANT PATCHES
  To patch different types of zero-day CMS vulnerabilities, we are always creating new WAF rules.
• FULL TRANSPARENT PROXY
  The BitNinja WAF2.0 module is simple to use. It doesn’t need any configuration or constant intervention.
• LOW-FALSE POITIVES
  Predefined rules ensure a low false-positive rate. Each domain pattern has false-positive statistics.
  BitNinja’s WAF module won the Firewall of the Year award at the Cyber Security Excellence Award in 2021.

DoS Detection vs. DoS Attacks

BitNinja monitors the connections to your server continuously. BitNinja will add an IP address to the blacklist every 60 seconds if there are too many concurrent connections. This is to ensure that no attacker’s IP addresses are used.

The IP address will then be added to the greylist. Valid users can remove the IP from the greylist if the login is genuine. BitNinja DoS Detection works with our AntiFlood Module. IPs that are repeatedly attacked by DoS will be blacklisted for a longer time.

The default threshold of 80 active connections simultaneously guarantees low false-positive rates and effectively blocks DoS attacks. This threshold can be set for each port and also for outbound and inbound connections.

BitNinja CAPTCHA page is protected from DoS attacks. It requires very little resources to run the CAPTCHA service.

What makes it different than other DoS Detection software?

• CUSTOM THRESHOLDS
  By default, IP addresses that exceed 80 active connections are blocked. You can set this threshold for each port.
• BLOCK OUTBOUND DOCS
  BitNinja DoS detection module blocks both inbound and outbound attacks.
• PROTECTION OF MANY PROTOCOLS
  BitNinja does more than just block HTTPS attacks. It also blocks FTP, POP3, IMAP, and any other TCP-based DoS attack.
• FALSE POSITIVE RATES LOW
  Our greylist and default thresholds provide maximum protection and low false-positive rates.

Botnets vs. Realtime IP Reputation

BitNinja’s revolutionary power is its database that contains information about 100,000,000 IP addresses around the world. BitNinja updates every server that is protected with the most recent information on which IPs have been detected as malicious. The defense shield gets stronger with each server that is added. BitNinja protects servers worldwide from attacks. If the IP of a BitNinja server is attacked, it will block that server’s IP. This is BitNinja’s exclusive technology, the Defense Network.

You can manage your user-level IP addresses by adding IPs, ranges and countries to them.

A first-of-its-kind industry-first IP reputation listing was also created. It goes beyond traditional black-and-white lists. The greylist allows for more flexibility in IP management and makes it easier to deal with false positives while blocking malicious requests. Valid human visitors can delist greylisted IPs by simply completing a CAPTCHA and the BitNinja Browser Integration Check (BIC).

What makes it different from other IP Reputation options?

• CONTINUOUS UPDATES
  Our IP Reputation List is constantly updated. Any BitNinja-protected server that is attacked is immediately added to our blacklist.
• DEFENSE NETWORK
  The Power of the Ninja Community, a global network of BitNinja-protected servers sharing information on the latest attacks, is called the Power of the Ninja Community. Our Defense Network gets stronger with every server added.
• GREYLIST
  Instead of blacklisting malicious IPs immediately, we created a new technology called the greylist. This technology blocks suspicious activity, but allows people to verify genuine requests.
• USER AND GLOBAL LEVEL
  All BitNinja protected server have access to the global grey-, white-, and blacklists. You can also manage all your server-level user lists from one place.

BitNinja’s IP Reputation module won the Bot Defense of the Year award at the Cyber Security Excellence Awards 2021.

Log Analysis vs. Bruteforce

Once BitNinja is installed, the Log Analysis module automatically detects the most common log files and begins to analyze them in a resource-friendly manner.

This module will instantly block brute force attacks and many other types of attacks such as SQL injection, directory traversal spamming attempts as well as WordPress user enumeration attack. Reflective DDoS via http://xmlrpc.php.

BitNinja Log Analysis is silent and doesn’t need to be configured. It monitors for malicious IP addresses in the background. Our real-time IP Reputation module automatically greylists malicious IP addresses when this module detects them. Our IP rules are constantly updated and log files are continuously monitored to ensure you have the most current protection for your server.

What makes it different from other Log Analysis software?

• ZERO CONFIG
  BitNinja Log Analysis runs automatically and doesn’t require any configuration. You can also configure the log paths and supervisors as you wish.
• RESOURCE-FRIENDLY
  For checking log file changes and pattern matching, we use the most efficient technologies (Auditd, AhoCorasick algorithm).
• LOW FALSE-POSITIVE RATES
  Test mode will first apply all incidents that are triggered by the new rules. We then carefully examine them to ensure a low rate of false-positives.
• FREQUENT RULE UPDATE
  Log Analysis module is constantly updated with new log files and rules to aid in auto-detecting.

Honeypots vs. scanning

By creating an automated decoy, you can prevent malicious IPs from scanning your server and stop hackers from accessing it. BitNinja Honeypots detect suspicious connections and block hackers from accessing the legitimate services on your servers.

The BitNinja Web Honeypot system turns backdoors that hackers use to gain access to your server via PHP web applications into traps that stop them from using your server’s resources. BitNinja will block Command&Control (C&C), botnet attack servers, from accessing your backdoors.

What makes Bitninja different than other Honeypot solutions?

• WEB AND PORT HONEYPOTS
  Two types of Honeypots are available: Port Honeypot is used to block open ports scanning and Web Honeypot is used to prevent hackers from scanning web applications for vulnerabilities.
• 100% COMPATIBLE
  Honeypots are not designed to interfere with the services that you have running on your server. Honeypots can only be used on ports that are not being used by the actual service.
• AUTOMATIC BLOCKING
  BitNinja Honeypots collect information on suspicious IPs and automatically block them to prevent future attacks.
• ZERO CONFIG
  To capture most attacks, 100 honeypots will be set up automatically. BitNinja can also automatically convert backdoors it finds into honeypots.

BitNinja won the Vulnerability Management Award of the Year at the Cyber Security Excellence Awards 2021.

To Wrap UP

BitNinja Server Security provides the best protection against cyberattacks. Your company is at risk every second you don’t have protection. Don’t waste time! Cybersecurity is no longer an option. It is essential! Register Now with our Hosting UK sales team, and let’s all make the internet safer together!