New targets, new threats emerge

Attackers focus on unpatched client applications, network operating systems

The cybersecurity landscape shifted seismically in 2005, leaving government and industry more vulnerable to data theft and security breaches than they have been in years. That is the sobering assessment in the SANS Institute's 2005 update of its annual 20 Most Critical Internet Security Vulnerabilities report.

The institute, a training and education organization for security professionals, was joined by the U.S. Computer Emergency Readiness Team (US-CERT) and the United Kingdom's National Infrastructure Security Co-ordination Centre in announcing the new findings Nov. 22.

In 2005 cybercriminals focused on attacking client applications and network operating systems other than Microsoft Windows, which don't receive automatic security patches, said Alan Paller, the institute's director of research.

"That means we're back to the Stone Age" of five years ago, before automated patching, when everyone had to find vulnerabilities and patch them manually, he said. "Those days are back in spades."

Driven by the realization that they can make a fortune in extortion and identity theft, cybercriminals have been launching massive attacks on those two largely undefended fronts in cyberspace, Paller said.

Flaws in client applications and network operating systems put critical national and corporate resources at risk, said Rohit Dhamankar, leader of the SANS Institute team and a security architect at 3Com's TippingPoint. People are most concerned about potential attacks on backup software, Web browser software and media players, he said.

But not all experts agree that the situation is dire. "I can't say we've ever exited the Stone Age," said Dragos Ruiu, chief organizer of the PacSec, CanSecWest and EUSecWest hacker conferences, which annually draw hundreds of hackers worldwide. The vulnerabilities have always been present, but cybercriminals have never attacked them so pervasively and maliciously, he said.

Numerous dangers

Ten of the top vulnerabilities are in cross-platform applications installed on millions of systems. They include backup, antivirus and database software, in addition to media players. Three affected network operating systems control routers, switches and other devices that form the Internet's backbone.

In the past year, the new types of attacks represented 65 percent of the worst threats, up from none in 2004, according to the institute. The new report cites several industry giants, including Cisco Systems and Microsoft, as being vulnerable to the new attacks.

Cybercriminals have released scores of automated harvesters on the Internet to hack systems and steal data, Paller said. With massive attacks lasting for weeks or months, criminals can steal an organization's data multiple times.

Security experts and vendors have traditionally put responsibility for patching on users, which has created huge gaps in information security, Paller said. Because application vendors don't automatically patch their products, he warned, some customers might never learn of an application's vulnerabilities unless they have signed up to receive regular alerts from US-CERT or a commercial alert service.

In addition, if customers who use the applications for archiving purposes don't update them, they are putting their most important data at risk, Paller said.

Some vendors such as Microsoft, Mozilla, Red Hat and Sun Microsystems now send security updates to their customers automatically because they know a vast majority of them can't consistently patch on their own, Paller said. But the report shows that this practice must become a standard industry rule, not an exception, he added.

A good heads-up

Software vendors and security experts generally praised the institute's report for pointing out important vulnerabilities, but they downplayed the report's strident warnings.

"Reports like this help change the public consciousness," said Lawrence Orans, research director of communications enterprise solutions at Gartner. Most information technology departments have no idea how many of their people are running cross-platform applications, and many network managers don't put the same emphasis on security that systems administrators do, he said.

"There is no equivalent to 'Patch Tuesday' in the Cisco world," he said, referring to Microsoft's weekly security updates.

The report notes an evolution, not a revolution, in public awareness of security threats, Ruiu said. Phishing, spyware infections and other attacks are becoming more common and taking more of the IT security staff's time and resources, he said. Attacks on backup software and Domain Name System software are real threats, he said, but it's a bit of a stretch to say all file-sharing and peer-to-peer software is vulnerable.

Despite the report's dire warnings that the threat landscape has changed, the reality is that long-standing threats are finally being recognized, Orans said. In particular, no one has been hurt by any of the network vulnerabilities, which have been known for some time, he said.

"Much has been made of these vulnerabilities, but they haven't materialized," he said. "The good guys are still finding and fixing vulnerabilities before the bad guys are able to execute zero-day attacks."

Many vendors are restricting access to services to customers who are not vulnerable, Orans said. Security auditing software is helping many customers repair vulnerabilities, and many security products have options for automatic updates, he said.

Power shift?

On the new cybersecurity playing field, Ruiu doesn't know if legitimate users or cybercriminals have the upper hand. The bad guys are more clever and know about more vulnerabilities, he said, but software is becoming harder to exploit because vendors are building in more security features from the start.

"I don't think the sky is falling," but the focus has shifted to vulnerabilities in different products, said David Marcus, a security research and communications manager at McAfee. The company already has automated patching for much of its antivirus software, especially for enterprise customers, Marcus said.

To adapt to the new environment, the federal government should change its procurement policy in the next 12 to 18 months to require all the software it buys to come with automated patching, Paller said.

The information security industry not only has to fix the current problem but also pre-empt the next one, Paller said. He thinks cyberattackers will next target appliances -- devices that have operating systems but no direct oversight by systems administrators. He predicts that more than 1 billion appliances will be in use in the next 10 years.

If the appliance vendors don't have automated patching for those products, Paller fears, each device could be an exploit waiting to happen.

More entries, more relevance?

The SANS Institute's 20 Most Critical Internet Security Vulnerabilities list has grown to include whole classes of software instead of single products, said Alan Paller, the institute's director of research. Dragos Ruiu, a hacker-conference organizer, said the list should now be called "SANS Top 200."

The institute has made the list "more representative of real-world threats but less useful as a quick hit list of things to nail down," Ruiu said. The list is now so extensive that large enterprises have no way of remedying all of the vulnerabilities on it, he added.

Some experts say the report contains nothing new or specific enough to be useful. "As far as I can tell, its basic message is that pretty much everything is vulnerable," said Pete Lindstrom, research director at Spire Security. Instead of providing a laundry list, the institute should be more rigorous and specific, he said.

The point of the report is to highlight problems that need to be fixed and make sure that they are, Paller said.

"We didn't [protest] loudly enough six years ago when Microsoft wasn't automatically patching, so it took an extra two to three years and hundreds of thousands of infected systems before automated patching came to Microsoft's operating systems," Paller said. "Now we're trying to make sure it doesn't happen again."

-- Michael Arnone

A shift in targets

Sixty percent of the vulnerabilities listed in the SANS Institute's 20 Most Critical Internet Security Vulnerabilities in 2005 affect client-side applications, said Gerhard Eschelbeck, chief technology officer and vice president of engineering at Qualys. The shift from attacking server applications to targeting client applications shows that much of the "low-hanging fruit" cybercriminals go after has been taken care of on the server side, he said.

For the first time, vulnerabilities in cross-platform applications and networking products dominated the annual list.

Cross-platform applications at risk:

  • Backup software.
  • Antivirus software.
  • PHP-based applications.
  • Database software.
  • File-sharing applications.
  • Domain Name System software.
  • Media players.
  • Instant-messaging applications.
  • Mozilla's Web browsers.
  • Other cross-platform applications, such as Sun Microsystems' Java.

Networking products at risk:

  • Cisco Systems' Internetwork Operating System and non-IOS products.
  • Configuration weaknesses in Cisco products.
  • Juniper Networks, Check Point Software Technologies and Symantec products.

-- Michael Arnone

The 2014 Federal 100

FCW is very pleased to profile the women and men who make up this year's Fed 100. 

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above