Study: Web Browsers Becoming Favorite Vulnerability For Hackers
Web browsers have emerged as a favorite vulnerability point for nefarious attackers looking to breach corporate IT security systems. Vital to everyday business operations, the Web browser must be protected from malware lurking on a fast-growing number of infected Web sites, according to Enterprise Management Associates (EMA), an IT management research and consulting firm.
According to recent analysis by Mike Montecillo, analyst, security and risk management for EMA (Fear Your Browser: It May be the Biggest Hole in Your Security Strategy), the increasing technology integrated into today's Web browsers has made them an easy target for computer attackers and hackers.
Hacking continues to evolve in sophistication and the Web browser now presents an opening for sensitive information to be stolen by increasingly simple methods. This includes basic coding that allows malicious Web sites to automatically steal sensitive information from visitors. Commonly associated with "seedy" Web sites ("warez," gambling and pornography), the threat of browser-based attacks has expanded to more "acceptable" sites that might include social networking, religious organization and university sites.
Further complicating the issue is the high demand for browser functionality that often outweighs the demand for security. Many well-known and useful technologies that are integrated with current browser environments, including Flash, ActiveX, QuickTime, Java and JavaScript, each pose a potential attack vector into the enterprise. Other vulnerabilities include how browsers themselves handle particular pieces of code, such as iFrames, whose weaknesses have been known to cause massive incidents in enterprises when exploited.
"Each and every Web site is a potential host for malicious code as hackers could potentially exploit even the most legitimate site as a means of hacking thousands of computers without the fear of reprisal," Montecillo said. "There is no end in sight to the number of malicious Web sites and browser-related vulnerabilities that can end up causing enterprise-wide breaches and incidents."
To help thwart browser-based security threats, IT security professionals increasingly are focusing resources and attention at better protecting the Web browser through hardy URL filtering solutions. These Web content filtering solutions block sites that are not related to business activities, greatly reducing the risk of browser-related infections. However, simple filtering methods will not completely eliminate the malware danger. More sophisticated solutions, such as anti-malware, automated code filtering and botnet detection, are currently being added to Web filtering technologies in an effort to thwart complex browser-related attacks.
Looking forward, EMA believes that the number of Web pages posing a serious threat to corporate IT will continue to increase at an alarming rate, raising browser vulnerabilities throughout 2008. Given the continued demand for an ever-wider range of browser functionality, Montecillo does not expect root-cause fixes to happen within the browser application. He does, however, anticipate that IT security vendors will launch new and innovative solutions during the year to advance Web content filtering to higher levels to meet the needs of increasingly sophisticated browser-based security strategies.