|
IBM online security report 2008
01/08/08
IBM has
released results from its X-Force 2008 Midyear Trend Statistics
report that indicates cyber-criminals are adopting new automation
techniques and strategies that allow them to exploit vulnerabilities
much faster than ever before.
The new tools
are being implemented on the Internet by organised criminal
elements, and at the same time public exploit code published by
researchers are putting more systems, databases and ultimately,
people at risk of compromise.
According to
the X-Force report, 94 percent of all browser-related online
exploits occurred within 24 hours of official vulnerability
disclosure. These attacks, known-as zero-day exploits, are on the
Internet before people even know they have a vulnerability that
needs to be patched in their systems.
This
phenomenon is being driven by sophisticated cyber-criminals adoption
and evolution of automated tools for creating and delivering exploit
tools, as well as the lack of a set protocol for disclosing
vulnerabilities in the research industry. The practice of disclosing
exploit code along with a security advisory has been the accepted
practice for many security researchers. However, according to the
X-Force report,
Vulnerabilities disclosed by independent researchers are twice as
likely to have zero-day exploit code published, calling into
question how researchers practice vulnerability disclosure and
signifying the need for a new standard in the industry.
The two major
themes in the first half of 2008 were acceleration and
proliferation, said X-Force Operations Manager Kris Lamb. We see a
considerable acceleration in the time a vulnerability is disclosed
to when it is exploited, with an accompanying proliferation of
vulnerabilities overall. Without a unified process for disclosing
vulnerabilities, the research industry runs the risk of actually
fuelling online criminal activity.
There is a
reason why X-Force doesn’t publish exploit code for the
vulnerabilities we have found, and perhaps it is time for others in
our field to reconsider this practice.
Key findings from the X-Force report include:
- Browser
plug-ins are the newest target-of-choice: The threat landscape has
evolved from the operating system to the Web browser to browser
plug-ins. In the first six months of 2008, roughly 78 percent of web
browser exploits targeted browser plug-ins.
- One-off
manual attacks are growing into massive automated attacks: More than
half of all vulnerability disclosures were related to web server
applications. Structured Query Language (SQL) injection
vulnerabilities, in particular, jumped from 25 percent in 2007 to 41
percent of all web server application vulnerabilities in the first
half of 2008, and corresponded with a rash of automated attacks that
compromised servers in an effort to compromise more endpoint
systems.
- Spammers go
back to basics: The complex spam of 2007 (image-based spam, file
attachment spam, etc.) has almost disappeared and now spammers are
using simple URL spam. This spam generally consists of a few simple
words and a URL, making it difficult for spam filters to detect.
Approximately 90 percent of spam is now URL spam.
- Russia
continues to be origin of most spam: Russia is responsible for 11
percent of the world?s spam followed by Turkey with 8 percent and
then the United States with 7.1 percent.
- Online
gamers are targets: As online games and virtual communities continue
to gain popularity, they are becoming an enticing target for
cyber-criminals. The X-Force report indicates that the top four
password-stealing Trojans were all aimed at gamers. The goal is to
steal gamers' virtual assets selling them for real money in online
market places.
- Financial
institutions remain key targets for phishers: All but two of the top
20 phishing targets were financial institutions.
- Secure
virtualisation grows in importance: Virtualisation-related
vulnerability disclosures have tripled since 2006 and are likely to
increase as virtualised environments become more widespread.
For more
security trends and predictions from IBM, including graphical
representations of security statistics, please access the full
report at:
www.ibm.com/services/us/iss/xforce/midyearreport
Nick Gibson, editor
|
