Top Internet security risks of 2007 revealed today

the money and found that it ended up in an account being used by a terrorist group that recruits suicide bombers.

Thousands of attacks such as those described above are happening every month. More than ten million computers have been compromised. Yesterday, the SANS Institute unveiled the 2007 Top 20 Internet Security Risks, the research group’s seventh annual update of its consensus list of the cyber security risks that caused the most damage to individuals, corporations and government agencies in 2007. Forty three security experts from government, industry, and academia in a half dozen countries cooperated to produce the consensus. This year’s SANS Top 20 illuminates two new attack targets that criminals have chosen to exploit and the older targets where attackers have significantly raised the stakes. Note that the Top 20 focuses on emerging attack patterns, but the old vulnerabilities are still being targeted by automated attack programs constantly scanning the web for vulnerable systems. So many automated programs are searching for victims that SANS Internet Storm Center, sort of an early warning system for the Internet, reports that computers can expect to survive only five minutes before being attacked and will withstand the attacks only if they are configured securely before being connected to the Internet.

“For most large and sensitive organizations the newest risks are the ones causing the most trouble,” says Alan Paller, director of research at SANS. He goes on to say, “the new risks are MUCH harder to defend; they take a level of commitment to continuous monitoring and uncompromising adherence to policy with real penalties, that only the largest banks and most sensitive military organizations have, so far, been willing to implement.” According to Paller, web application insecurity is particularly troublesome because so many developers are writing and deploying web applications without ever demonstrating that they can write secure applications. Most of their web applications provide access to back-end databases that hold sensitive information. Says Paller, “Until colleges that teach programmers and companies that employ programmers ensure that developers learn secure coding, and until those employers ensure that they work in an effective secure development life cycle, we will continue to see major vulnerabilities in nearly half of all web applications” (a week ago, by the way, the Secure Programming Council released the first standard of due care for the security knowledge and skills that web programmers should be able to demonstrate)

This year’s top 20 project was led by Rohit Dhamankar, senior manager of security research for Austin, Texas-based TippingPoint, a specialist in intrusion prevention systems. According to Dhamankar, “Although half the total vulnerabilities reported in 2007 are in web applications, it’s only the tip-of-the-iceberg. These data exclude vulnerabilities in custom developed web applications. Compromised websites provide avenues for massive client-side compromises via web browser, office documents and media player exploits. This vicious circle of compromise is proving to be harder to break each day”. Redwood Shores, California-based Qualys scans for vulnerabilities on millions of systems in hundreds of large organizations around the world. “We have seen a huge jump in the vulnerabilities in Microsoft Office products,” says Amol Sawarte, manager of vulnerability labs at Qualys. These charts show growth of nearly 300 percent from 2006 to 2007, primarily in new Excel vulnerabilities that can easily be exploited by getting unsuspecting users to open Excel files sent via email and instant message. When systems are compromised through any of the new attack targets, spyware infections (including keystroke loggers) are among the most common result. Webroot, the largest spyware detection and monitoring firm, keeps track of how spyware is spreading. Gerhard Eschelbeck, CTO of Webroot, reports that “Since January 2007, Webroot has seen a 183 percent increase in Websites harboring spyware. (2) Infection rates for Spyware and Trojans that steal keystrokes are currently at 31 percent and rapidly growing, (3) Based on a small and medium size enterprise survey we conducted in September 2007 seventy-seven percent said their success depends on the Internet, and 47.2 percent reported lost sales due to spyware.”

The Top 20 will be presented to the public today in a meeting in London, jointly sponsored by SANS and the UK CPNI (Centre for Protection of National Infrastructure).