New targets, new threats emerge

The cybersecurity landscape shifted seismically in 2005, leaving government and industry more vulnerable to data theft and security breaches than they have been in years. That is the sobering assessment in the SANS Institute's 2005 update of its annual 20 Most Critical Internet Security Vulnerabilities report.

The institute, a training and education organization for security professionals, was joined by the U.S. Computer Emergency Readiness Team (US-CERT) and the United Kingdom's National Infrastructure Security Co-ordination Centre in announcing the new findings Nov. 22.

In 2005 cybercriminals focused on attacking client applications and network operating systems other than Microsoft Windows, which don't receive automatic security patches, said Alan Paller, the institute's director of research.

"That means we're back to the Stone Age" of five years ago, before automated patching, when everyone had to find vulnerabilities and patch them manually, he said. "Those days are back in spades."

Driven by the realization that they can make a fortune in extortion and identity theft, cybercriminals have been launching massive attacks on those two largely undefended fronts in cyberspace, Paller said.

Flaws in client applications and network operating systems put critical national and corporate resources at risk, said Rohit Dhamankar, leader of the SANS Institute team and a security architect at 3Com's TippingPoint. People are most concerned about potential attacks on backup software, Web browser software and media players, he said.

But not all experts agree that the situation is dire. "I can't say we've ever exited the Stone Age," said Dragos Ruiu, chief organizer of the PacSec, CanSecWest and EUSecWest hacker conferences, which annually draw hundreds of hackers worldwide. The vulnerabilities have always been present, but cybercriminals have never attacked them so pervasively and maliciously, he said.

Numerous dangers

Ten of the top vulnerabilities are in cross-platform applications installed on millions of systems. They include backup, antivirus and database software, in addition to media players. Three affected network operating systems control routers, switches and other devices that form the Internet's backbone.

In the past year, the new types of attacks represented 65 percent of the worst threats, up from none in 2004, according to the institute. The new report cites several industry giants, including Cisco Systems and Microsoft, as being vulnerable to the new attacks.

Cybercriminals have released scores of automated harvesters on the Internet to hack systems and steal data, Paller said. With massive attacks lasting for weeks or months, criminals can steal an organization's data multiple times.

Security experts and vendors have traditionally put responsibility for patching on users, which has created huge gaps in information security, Paller said. Because application vendors don't automatically patch their products, he warned, some customers might never learn of an application's vulnerabilities unless they have signed up to receive regular alerts from US-CERT or a commercial alert service.

In addition, if customers who use the applications for archiving purposes don't update them, they are putting their most important data at risk, Paller said.

Some vendors such as Microsoft, Mozilla, Red Hat and Sun Microsystems now send security updates to their customers automatically because they know a vast majority of them can't consistently patch on their own, Paller said. But the report shows that this practice must become a standard industry rule, not an exception, he added.

A good heads-up

Software vendors and security experts generally praised the institute's report for pointing out important vulnerabilities, but they downplayed the report's strident warnings.

"Reports like this help change the public consciousness," said Lawrence Orans, research director of communications enterprise solutions at Gartner. Most information technology departments have no idea how many of their people are running cross-platform applications, and many network managers don't put the same emphasis on security that systems administrators do, he said.

"There is no equivalent to 'Patch Tuesday' in the Cisco world," he said, referring to Microsoft's weekly security updates.

The report notes an evolution, not a revolution, in public awareness of security threats, Ruiu said. Phishing, spyware infections and other attacks are becoming more common and taking more of the IT security staff's time and resources, he said. Attacks on backup software and Domain Name System software are real threats, he said, but it's a bit of a stretch to say all file-sharing and peer-to-peer software is vulnerable.

Despite the report's dire warnings that the threat landscape has changed, the reality is that long-standing threats are finally being recognized, Orans said. In particular, no one has been hurt by any of the network vulnerabilities, which have been known for some time, he said.

"Much has been made of these vulnerabilities, but they haven't materialized," he said. "The good guys are still finding and fixing vulnerabilities before the bad guys are able to execute zero-day attacks."

Many vendors are restricting access to services to customers who are not vulnerable, Orans said. Security auditing software is helping many customers repair vulnerabilities, and many security products have options for automatic updates, he said.

Power shift?

On the new cybersecurity playing field, Ruiu doesn't know if legitimate users or cybercriminals have the upper hand. The bad guys are more clever and know about more vulnerabilities, he said, but software is becoming harder to exploit because vendors are building in more security features from the start.

"I don't think the sky is falling," but the focus has shifted to vulnerabilities in different products, said David Marcus, a security research and communications manager at McAfee. The company already has automated patching for much of its antivirus software, especially for enterprise customers, Marcus said.

To adapt to the new environment, the federal government should change its procurement policy in the next 12 to 18 months to require all the software it buys to come with automated patching, Paller said.

The information security industry not only has to fix the current problem but also pre-empt the next one, Paller said. He thinks cyberattackers will next target appliances -- devices that have operating systems but no direct oversight by systems administrators. He predicts that more than 1 billion appliances will be in use in the next 10 years.

If the appliance vendors don't have automated patching for those products, Paller fears, each device could be an exploit waiting to happen.