Vulnerabilities inside and out

Inside threats are, by far, the most dangerous challenges in today's network security

I've often said in my columns how client-side attacks should be most administrators' No. 1 exploit worry. It's less and less common for attackers to break in through the front door. If I want to steal from a company over the Internet, it's much harder (these days) to find an exploit on the company's Web site or back-end database server. This is not to say that these types of attacks don't happen; they do, as any day's headlines will reveal. But it's not the most common way my clients are reporting. It's more likely that an end-user accidentally launched a worm or a bot that led to the compromise.

Spam a hundred malicious e-mails to an entity's employees and you're almost guaranteed to get a client-side execution. All the end-user education in the world still doesn't work if the spam e-mail looks authentic enough (that is, spear phishing). The end-user executes the client-side code or inputs their network credentials into a phish Web site, and the remote hacker has a backdoor tunnel that bypasses firewalls, IPSs, and all other security controls. Maybe you think you're safe because your end-users aren't logged on as admin or root. No worry: Standard end-users usually have more than enough access to let the hacker get what they want.

Why rob a bank with a gun when you're only going to get a few thousand dollars at most, along with an exploding dye pack and a guaranteed 5-to-25 years in prison? Instead, buy a spamming bot for a few hundred dollars, spend a few hours customizing your attack, and steal tens of thousands to millions. Your risk of getting caught is almost nil. And if you're one of the very few, unfortunate criminals that actually does get caught, you'll be hard-pressed to spend any time in jail. Usually the fines are less than what the criminal made in one day's haul.

If you're working on your company's computer security strategy, pay at least as much attention to your client-side protections as you do preventing malicious hackers coming through the front door.

In order to back up this assertion, I decided to do some research (I apologize ahead of time as I concentrated on only Microsoft Windows exploits). I wanted to find out how many exploits were client-side attacks that required end-user interaction versus remotely exploitable attacks requiring no end-user interaction.

Attack-type research

An example of the latter is when a remote hacker or worm runs a buffer overflow against a default installed, advertising service and gets complete control of the machine. MS-Blaster and Code Red are examples of this type of attack. Client-side, interactive exploits, on the one hand, require the user to click on or do something. Alternately, remote, non-interactive exploits are normally more dangerous than client-side attacks. An attacker can launch a single such attack, and it will break into millions of unpatched computers in a day. Client-side exploits, because they require end-user interaction, just don't spread as fast (although there are exceptions, such as the Melissa virus and Iloveyou worm).

For my research, I used my favorite vulnerability announcement site, Secunia, and compared it to Microsoft's own security bulletins and to the Mitre CVE database. I concentrated on Windows XP Pro SP2 and later Windows OSes, and any vulnerability announced capable of running on those platforms (such as OS, IE, Windows Media Player, Microsoft Office, and so on), focusing on the years 2006 and 2007. I ended up reviewing 270 separate CVE-rated vulnerabilities in 136 security bulletins.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Roger A. Grimes

InfoWorld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?