Vulnerabilities inside and out

Inside threats are, by far, the most dangerous challenges in today's network security

I've often said in my columns how client-side attacks should be most administrators' No. 1 exploit worry. It's less and less common for attackers to break in through the front door. If I want to steal from a company over the Internet, it's much harder (these days) to find an exploit on the company's Web site or back-end database server. This is not to say that these types of attacks don't happen; they do, as any day's headlines will reveal. But it's not the most common way my clients are reporting. It's more likely that an end-user accidentally launched a worm or a bot that led to the compromise.

Spam a hundred malicious e-mails to an entity's employees and you're almost guaranteed to get a client-side execution. All the end-user education in the world still doesn't work if the spam e-mail looks authentic enough (that is, spear phishing). The end-user executes the client-side code or inputs their network credentials into a phish Web site, and the remote hacker has a backdoor tunnel that bypasses firewalls, IPSs, and all other security controls. Maybe you think you're safe because your end-users aren't logged on as admin or root. No worry: Standard end-users usually have more than enough access to let the hacker get what they want.

Why rob a bank with a gun when you're only going to get a few thousand dollars at most, along with an exploding dye pack and a guaranteed 5-to-25 years in prison? Instead, buy a spamming bot for a few hundred dollars, spend a few hours customizing your attack, and steal tens of thousands to millions. Your risk of getting caught is almost nil. And if you're one of the very few, unfortunate criminals that actually does get caught, you'll be hard-pressed to spend any time in jail. Usually the fines are less than what the criminal made in one day's haul.

If you're working on your company's computer security strategy, pay at least as much attention to your client-side protections as you do preventing malicious hackers coming through the front door.

In order to back up this assertion, I decided to do some research (I apologize ahead of time as I concentrated on only Microsoft Windows exploits). I wanted to find out how many exploits were client-side attacks that required end-user interaction versus remotely exploitable attacks requiring no end-user interaction.

Attack-type research

An example of the latter is when a remote hacker or worm runs a buffer overflow against a default installed, advertising service and gets complete control of the machine. MS-Blaster and Code Red are examples of this type of attack. Client-side, interactive exploits, on the one hand, require the user to click on or do something. Alternately, remote, non-interactive exploits are normally more dangerous than client-side attacks. An attacker can launch a single such attack, and it will break into millions of unpatched computers in a day. Client-side exploits, because they require end-user interaction, just don't spread as fast (although there are exceptions, such as the Melissa virus and Iloveyou worm).

For my research, I used my favorite vulnerability announcement site, Secunia, and compared it to Microsoft's own security bulletins and to the Mitre CVE database. I concentrated on Windows XP Pro SP2 and later Windows OSes, and any vulnerability announced capable of running on those platforms (such as OS, IE, Windows Media Player, Microsoft Office, and so on), focusing on the years 2006 and 2007. I ended up reviewing 270 separate CVE-rated vulnerabilities in 136 security bulletins.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Roger A. Grimes

InfoWorld

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?