Study: Internet Security Risks Of 2007 Point To Two Major Transformations In Attacker Targets
The cyber arms race continues. Cyber criminals and cyber spies have shifted their focus again, successfully evading the countermeasures that most companies and government agencies have worked for years to put into place. Facing real improvements in system and network security, the attackers now have two new prime targets that allow them to evade firewalls, antivirus and even intrusion prevention tools: users who are easily misled and custom-built applications. This is a major shift from prior years when attackers limited most of their targets to flaws in commonly used software.
Scenario 1: The Chief Information Security Officer of a medium sized, but sensitive, federal agency learned that his computer was sending data to computers in China. He had been the victim of a new type of spear phishing attack highlighted in this year's Top 20. Once they got inside, the attackers had freedom of action to use his personal computer as a tunnel into his agency’s systems.
Scenario 2. Hundreds of senior federal officials and business executives visited a political think-tank Web site that had been infected and caused their computers to become zombies. Keystroke loggers, placed on their computers by the criminals (or nation-state), captured their user names and passwords when they signed on to their personal bank accounts, and their stock trading accounts and their employers computers, and sent the data to computers in different countries. Bank balances were depleted; stock accounts lost money; servers inside their organizations were compromised and sensitive data was copied and sent to outsiders. Back doors were placed on some of those computers and are still there.
Scenario 3. A hospitals Web site was compromised because a Web developer made a programming error. Sensitive patient records were taken. When the criminals proved they had the data, the hospital had to choose between paying extortion or allowing their patients health records to be spread all over the Internet.
Scenario 4. A teenager visits a Web site that exploits the old version of her media player that she never updated. She didn't do anything but visit the site; the video started up automatically when the page opened. The attacker put a key stroke logger on her computer. Her father used the same computer to access the family bank account. The attackers got his user name and password and emptied his bank account (the bank reimbursed him). U.S. law enforcement officials followed the money and found that it ended up in an account being used by a terrorist group that recruits suicide bombers.
All of these scenarios are composites of actual events. To protect the victims from more embarrassment, facts have been altered and segments of multiple attacks have been combined. Thousands of attacks like these are happening every month. More than 10 million computers have been compromised.
Recently, the SANS Institute unveiled the 2007 Top 20 Internet Security Risks, the research group's seventh annual update of its consensus list of the cyber security risks that caused the most damage to individuals, corporations, and government agencies in 2007. Forty three security experts from government, industry, and academia in a half dozen countries cooperated to produce the consensus. Their names are listed in the Top 20, available at www.sans.org/top20.
This year's SANS Top 20 illuminates two new attack targets that criminals have chosen to exploit and the older targets where attackers have significantly raised the stakes. Although the Top 20 focuses on emerging attack patterns, the old vulnerabilities are still being targeted by automated attack programs constantly scanning the Web for vulnerable systems. So many automated programs are searching for victims that SANS Internet Storm Center (an early warning system for the Internet) reports that computers can expect to survive only five minutes before being attacked and will withstand the attacks only if they are configured securely before being connected to the Internet.
"For most large and sensitive organizations, the newest risks are the ones causing the most trouble," said Alan Paller, director of research at SANS. "The new risks are MUCH harder to defend; they take a level of commitment to continuous monitoring and uncompromising adherence to policy with real penalties, that only the largest banks and most sensitive military organizations have, so far, been willing to implement," continues Paller.
According to Paller, Web application insecurity is particularly troublesome because so many developers are writing and deploying Web applications without ever demonstrating that they can write secure applications. Most of their Web applications provide access to back-end databases that hold sensitive information.
"Until colleges that teach programmers and companies that employ programmers ensure that developers learn secure coding, and until those employers ensure that they work in an effective secure development life cycle, we will continue to see major vulnerabilities in nearly half of all Web applications," Paller said.
This year's Top 20 project was led by Rohit Dhamankar, senior manager of security research for TippingPoint.
"Although half the total vulnerabilities reported in 2007 are in Web applications, its only the tip-of-the-iceberg,” Dhamankar said. “These data exclude vulnerabilities in custom developed Web applications. Compromised Web sites provide avenues for massive client-side compromises via Web browser, office documents, and media player exploits. This vicious circle of compromise is proving to be harder to break each day."