Attackers find old vulnerabilities are still the best
Connecting state and local government leaders
Despite a reduction in the number of new vulnerabilities being reported, attackers still find plenty of weaknesses to exploit, according to a new report from HP.
The number of new vulnerabilities being discovered has leveled off for the past two years and is well down from its 2006 peak, according to a report on 2010 security trends from Hewlett-Packard, an indication that secure software development is beginning to mature.
But that is small comfort, as attackers continue to successfully exploit existing vulnerabilities, said Dan Holden, director of HP DVLabs and a contributor to the report.
“There is a lot of attack surface for the attackers to choose,” Holden said. “They don’t need any more vulnerabilities to be successful.”
Related stories:
The cure is known, but the cyber disease persists
Patch management: It's not sexy, but it can keep you secure
Attackers are supported in their efforts by exploit toolkits that are becoming more professional and better packaged and by the lack of patching done by many computer users to correct known vulnerabilities in software.
Most enterprises have policies and automated processes in place for patch management and use commercial services to shield themselves from threats until patches are in place. But home computer users too often ignore patching. Although the technology exists to automatically update home systems, “a lot of them aren’t automatically updating,” Holden said, leaving a large pool of vulnerable computers that are being recruited into botnets for the distribution of malware and other malicious activity.
The "2011 Top Cybersecurity Risks Report" is produced by HP DVLabs and HP TippingPoint, drawing on data from the Open Source Vulnerability Database, an independent database with information on more than 70,000 vulnerabilities in 32,000 products.
According to the OSVD figures, more than 7,900 vulnerabilities were reported last year, up slightly from 2009 but down from the four-year average of about 8,500. The number of reported vulnerabilities peaked in 2006 at about 11,000. Nearly half of reported vulnerabilities are in Web applications.
“The staggering number of Web application vulnerabilities, combined with more effective exploitation methods, demonstrates why attackers continue to target these systems,” according to the report. Vulnerabilities allowing cross-site scripting are the most common type, followed by SQL injection and denial of service.
There is a shifting pattern in where these vulnerabilities are showing up, with more occurring in plug-ins that enhance an application’s functionality rather than in the core application.
“The Web browsers do get patched more regularly than the plug-ins,” Holden said.
A study of some popular content management systems showed that from 2006 through 2010, the percentage of vulnerabilities found in the core application has decreased while those appearing in third-party plug-ins has increased.
The exploit of existing vulnerabilities is increasingly done through toolkits that allow third parties and people without a great deal of technical expertise to carry out attacks.
“The past several years have been witness to an unparalleled and astonishingly rapid development in the world of cyber crime — the emergence of a brand new underground ecosystem brought on by vast improvements in malicious software,” the report states.
This criminal ecosystem includes professionally packaged kits that build on years of experience. “The kits use old, tried-and-true vulnerabilities,” said Mike Dausin, HP’s advanced security intelligence team lead. “But they work. The attackers don’t need bleeding-edge vulnerabilities to get the job done.”
One class of threat that is not covered in the report is the advanced persistent threat, which has gained visibility in the last year with attacks against high-profile targets, beginning with Google in January 2010 and continuing through a recent breach at RSA.
Advanced persistent threat, or APT, is a broad descriptive term for targeted, often multivector threats that are crafted to penetrate a specific system and remain quietly hidden while information, often intellectual property, is gathered.
Despite their recent notoriety, the attacks are not new, Holden said.
“Our industry is sometimes more buzzy than the fashion industry,” he said. “APT is an acronym thrown at something that has been with us all along.”
While public attention has been focused on the blunt instrument of the botnet, motivated attackers with generous resources have been targeting government systems with sophisticated tools for years, he said.
“The government has been dealing with this for a very long time,” Holden said. Now it has become an issue for the private sector as well.