Top Internet Security Risks of 2007

hacker.jpgCyber criminals and cyber spies have shifted their focus again, successfully evading the countermeasures that most companies and government agencies have worked for years to put into place. Facing real improvements in system and network security, the attackers now have two new prime targets that allow them to evade firewalls, antivirus and even intrusion prevention tools: users who are easily misled and custom-built applications. This is a major shift from prior years when attackers limited most of their targets to flaws in commonly used software.

Scenario 1: The Chief Information Security Officer of a medium sized, but sensitive federal agency learned that his computer was sending data to computers in China. He had been the victim of a new type of spear phishing attack highlighted in this years’ Top 20. Once they got inside, the attackers had freedom of action to use his personal computer as a tunnel into his agency’s systems.

Scenario 2: Hundreds of senior federal officials and business executives visited a political think-tank web site that had been infected and caused their computers to become zombies. Keystroke loggers, placed on their computers by the criminals (or nation-state), captured their user names and passwords when they signed on to their personal bank accounts, and their stock trading accounts and their employers’ computers, and sent the data to computers in different countries. Bank balances were depleted; stock accounts lost money; servers inside their organizations were compromised and sensitive data was copied and sent to outsiders. Back doors were placed on some of those computers and are still there.

Scenario 3. A hospital’s web site was compromised because a web developer made a programming error. Sensitive patient records were taken. When the criminals proved they had the data, the hospital had to choose between paying extortion or allowing their patients’ health records to be spread all over the Internet.

Scenario 4. A teenager visits a web site that exploits the old version of her media player that she never updated. She didn’t do anything but visit the site; the video started up automatically when the page opened. The attacker put a key stroke logger on her computer. Her father used the same computer to access the family bank account. The attackers got his user name and password and emptied his bank account (the bank reimbursed him). US law enforcement officials followed the money and found that it ended up in an account being used by a terrorist group that recruits suicide bombers.

All of these scenarios are composites of actual events. To protect the victims from more embarrassment, facts have been altered and segments of multiple attacks have been combined. Thousands of attacks like these are happening every month. More than ten million computers have been compromised.

On November 27, the SANS Institute will unveil the 2007 Top 20 Internet Security Risks, the research group’s seventh annual update of its consensus list of the cyber security risks that caused the most damage to individuals, corporations and government agencies in 2007. Forty three security experts from government, industry and academia in a half dozen countries cooperated to produce the consensus. Their names are listed in the Top 20 which is available online at

This year’s SANS Top 20 illuminates two new attack targets that criminals have chosen to exploit and the older targets where attackers have significantly raised the stakes. Although the Top 20 focuses on emerging attack patterns, the old vulnerabilities are still being targeted by automated attack programs constantly scanning the web for vulnerable systems. So many automated programs are searching for victims that SANS Internet Storm Center (an early warning system for the Internet) reports that computers can expect to survive only five minutes before being attacked and will withstand the attacks only if they are configured securely before being connected to the Internet.

A summary of the highlights of year’s Top 20, along with the most effective defenses, is attached at the end of this document.

“For most large and sensitive organizations the newest risks are the ones causing the most trouble,” says Alan Paller, Director of Research at SANS. He goes on to say, “the new risks are MUCH harder to defend; they take a level of commitment to continuous monitoring and uncompromising adherence to policy with real penalties, that only the largest banks and most sensitive military organizations have, so far, been willing to implement.”

According to Paller, web application insecurity is particularly troublesome because so many developers are writing and deploying web applications without ever demonstrating that they can write secure applications. Most of their web applications provide access to back-end databases that hold sensitive information. Says Paller, “Until colleges that teach programmers and companies that employ programmers ensure that developers learn secure coding, and until those employers ensure that they work in an effective secure development life cycle, we will continue to see major vulnerabilities in nearly half of all web applications.” [On November 20, 2007, the Secure Programming Council released the first standard of due care for the security knowledge and skills that web programmers should be able to demonstrate. Interested parties can see the report at

This year’s top 20 project was led by Rohit Dhamankar, senior manager of security research for TippingPoint, the company that understands the attack vectors because they make intrusion prevention systems trusted by many of the most sensitive enterprises. According to Dhamankar, “Although half the total vulnerabilities reported in 2007 are in web applications, it’s only the tip-of-the-iceberg. These data exclude vulnerabilities in custom developed web applications. Compromised websites provide avenues for massive client-side compromises via web browser, office documents and media player exploits. This vicious circle of compromise is proving to be harder to break each day”.

Qualys, the firm that scans for vulnerabilities on millions of systems in hundreds of large organizations around the world, has an excellent perspective on where new vulnerabilities are being discovered. “We have seen a huge jump in the vulnerabilities in Microsoft Office products,” says Amol Sawarte, Manager of Vulnerability Labs at Qualys. These charts show growth of nearly 300% from 2006 to 2007, primarily in new Excel vulnerabilities that can easily be exploited by getting unsuspecting users to open Excel files sent via email and instant message.

When systems are compromised through any of the new attack targets, spyware infections (including keystroke loggers) are among the most common result. Webroot, the largest spyware detection and monitoring firm, keeps track of how spyware is spreading. Gerhard Eschelbeck, Chief Technology Officer of Webroot reports that: “Since January 2007, Webroot has seen a 183 percent increase in Websites harboring spyware. (2) Infection rates for Spyware and Trojans that steal keystrokes are currently at 31 percent and rapidly growing, (3) Based on a small and medium size enterprise survey we conducted in September 2007 seventy-seven percent said their success depends on the Internet, and 47.2 percent reported lost sales due to spyware.”

The Top 20 will be presented to the public in a meeting in London on November 28, jointly sponsored by SANS and the UK CPNI (Centre for Protection of National Infrastructure), where 200 leading UK security practitioners will gather to learn about the Top 20 and discuss countermeasures. The meeting, at 1700 UTC, is open to the press.
Free Testing Tools

As in past years, Qualys is making available a free service that tests computers for the elements on the Top 20 amenable to such testing. That service can be accessed at Sans20

This year, Applicure Technologies, a web application firewall firm, is offering a free monitoring tool that assesses how many web attacks are hitting IIS and Apache servers. It is available at Applicure.

  1. No trackbacks yet.

You must be logged in to post a comment.
%d bloggers like this: