Vulnerabilities inside and out

Inside threats are, by far, the most dangerous challenges in today's network security

I've often said in my columns how client-side attacks should be most administrators' No. 1 exploit worry. It's less and less common for attackers to break in through the front door. If I want to steal from a company over the Internet, it's much harder (these days) to find an exploit on the company's Web site or back-end database server. This is not to say that these types of attacks don't happen; they do, as any day's headlines will reveal. But it's not the most common way my clients are reporting. It's more likely that an end-user accidentally launched a worm or a bot that led to the compromise.

Spam a hundred malicious e-mails to an entity's employees and you're almost guaranteed to get a client-side execution. All the end-user education in the world still doesn't work if the spam e-mail looks authentic enough (that is, spear phishing). The end-user executes the client-side code or inputs their network credentials into a phish Web site, and the remote hacker has a backdoor tunnel that bypasses firewalls, IPSs, and all other security controls. Maybe you think you're safe because your end-users aren't logged on as admin or root. No worry: Standard end-users usually have more than enough access to let the hacker get what they want.

Why rob a bank with a gun when you're only going to get a few thousand dollars at most, along with an exploding dye pack and a guaranteed 5-to-25 years in prison? Instead, buy a spamming bot for a few hundred dollars, spend a few hours customizing your attack, and steal tens of thousands to millions. Your risk of getting caught is almost nil. And if you're one of the very few, unfortunate criminals that actually does get caught, you'll be hard-pressed to spend any time in jail. Usually the fines are less than what the criminal made in one day's haul.

If you're working on your company's computer security strategy, pay at least as much attention to your client-side protections as you do preventing malicious hackers coming through the front door.

In order to back up this assertion, I decided to do some research (I apologize ahead of time as I concentrated on only Microsoft Windows exploits). I wanted to find out how many exploits were client-side attacks that required end-user interaction versus remotely exploitable attacks requiring no end-user interaction.

Attack-type research

An example of the latter is when a remote hacker or worm runs a buffer overflow against a default installed, advertising service and gets complete control of the machine. MS-Blaster and Code Red are examples of this type of attack. Client-side, interactive exploits, on the one hand, require the user to click on or do something. Alternately, remote, non-interactive exploits are normally more dangerous than client-side attacks. An attacker can launch a single such attack, and it will break into millions of unpatched computers in a day. Client-side exploits, because they require end-user interaction, just don't spread as fast (although there are exceptions, such as the Melissa virus and Iloveyou worm).

For my research, I used my favorite vulnerability announcement site, Secunia, and compared it to Microsoft's own security bulletins and to the Mitre CVE database. I concentrated on Windows XP Pro SP2 and later Windows OSes, and any vulnerability announced capable of running on those platforms (such as OS, IE, Windows Media Player, Microsoft Office, and so on), focusing on the years 2006 and 2007. I ended up reviewing 270 separate CVE-rated vulnerabilities in 136 security bulletins.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Roger A. Grimes

InfoWorld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?