Android Apps, Internet Explorer, Java Among the Most Vulnerable: HP

 
 
By Nathan Eddy  |  Posted 2014-02-05 Email Print this article Print
 
 
 
 
 
 
 
 

With the cost of cyber-crime rising at an alarming rate and several organizations calling attention to the increase in the use of exploits in the wild, Hewlett-Packard's cyber-risk report this year focuses on specific areas of the attack surface, the technologies that define them, and the vulnerabilities and actors that drive how they are abused. The report provides a broad view of the vulnerability and threat landscape, ranging from industry wide data to a focused look at different technologies—including mobile apps, Internet Explorer and Java. The goal of the report is to provide security information that can be used to understand the vulnerability landscape and best deploy resources to minimize security risk. "The complexity and difficulty of securing enterprises only grows with the passage of time. But with the right information, organizations can significantly reduce their attack surface, substantially mitigate risks, and prevent the losses and damages associated with successful attacks," the report noted. This eWEEK slide show examines key findings of the HP study.

 
 
 
  • Android Apps, Internet Explorer, Java Among the Most Vulnerable: HP

    by Nathan Eddy
    1 - Android Apps, Internet Explorer, Java Among the Most Vulnerable: HP
  • Android Applications Use Encryption Improperly

    As the lines are blurred between mobile technology and traditional form factors, and mobile devices are often used to manipulate confidential data for both personal and business use, encryption of targeted data is increasingly important. The report found that 46 percent of Android apps improperly use encryption.
    2 - Android Applications Use Encryption Improperly
  • Internet Explorer the Most Targeted Software

    Many more vulnerabilities were discovered for Internet Explorer in 2013, and HP's Zero Day Initiative (ZDI) recorded more than a 100 percent increase, compared with 2012 numbers. The report said this is not a gauge of the security of Internet Explorer, but rather, results from the market forces (both legitimate and illegitimate) that govern the price of vulnerabilities in software with massive market penetration.
    3 - Internet Explorer the Most Targeted Software
  • Clients, Servers Both Susceptible to Attack

    The 216 unique vulnerability categories detected during the audits were distributed almost evenly between two major buckets. Nearly 52 percent of the issues were a result of insecure client-side operation while about 48 percent were related to either insecure server-side application code or code quality issues that could result in unstable application behavior.
    4 - Clients, Servers Both Susceptible to Attack
  • SCADA Systems Are Increasingly Targeted

    Another extremely tempting target—supervisory control and data acquisition (SCADA) systems—first gained attention after the Stuxnet worm was discovered to have infiltrated an Iranian uranium enrichment plant in 2010 and specifically targeted equipment manufactured by one company. ZDI's external researchers are actively interested in finding, and disclosing these vulnerabilities.
    5 - SCADA Systems Are Increasingly Targeted
  • Cross-Site Scripting a Top Vulnerability

    One of the most prolific vulnerabilities over the past decade, cross-site scripting stands at the top regarding the frequency in which it appears in the affected applications. Although 82 percent of the affected applications demonstrated weaknesses to type one , or "reflected," cross-site scripting, the category with the highest impact comprises a mere 5 percent of the applications—type two, or "persistent," cross-site scripting.
    6 - Cross-Site Scripting a Top Vulnerability
  • Java Remains a Target for Exploitation

    Since early 2011, Oracle has patched almost 300 remotely exploitable vulnerabilities in Java. These issues range from the classic stack-based buffer overflow to the more complicated sandbox bypass vulnerabilities that require the attacker to chain a series of weaknesses to disable the security manager. Every year, the number of vulnerabilities being fixed has increased, with just over 50 issues patched in all of 2011 to more than 180 in 2013, and researchers continue to discover new ways to find holes in the various subcomponents of Java and bypass the security architecture.
    7 - Java Remains a Target for Exploitation
  • Differing Definitions of Malware Make Measuring Difficult

    The company's examination of more than 500,000 apps for the Android platform turned up some surprising results, including major discrepancies between how Google and different antivirus companies judge the behavior and intent of mobile apps. Limiting the number of apps available within an organization, monitoring approved apps and thoroughly vetting end-user licensing agreements are the absolute baseline for responsible defense, the report said.
    8 - Differing Definitions of Malware Make Measuring Difficult
  • South Korea: A Case Study in Vulnerability

    As discovered in analyzing targeted attacks in the South Korea—in which a malware payload was executed last March on computers belonging to targeted businesses and organizations in the country—even though the malware involved was not that sophisticated, it was good enough to compromise the networks of several organizations and cause malicious damage and significant interruptions to normal function. The report warned that organizations must understand that there isn't a single path to take to protect vital business assets from threats.
    9 - South Korea: A Case Study in Vulnerability
  • Apple's Screening Process Makes iOS Safer

    Compared with the high detection numbers for Android apps reported by particular companies, things look different for iOS, with few reports of malware for this platform. A major difference between the Android and iOS app platforms is the screening process of the app store. The Apple iOS store performs a detailed screening process that can take weeks and will reject apps for a number of nontechnical reasons, including test or demo versions and apps that are primarily marketing materials or advertisements.
    10 - Apple's Screening Process Makes iOS Safer
  • Vulnerability Disclosures Decrease in Severity

    While vulnerability research continued to gain attention, the total number of publicly disclosed vulnerabilities in 2013 was stable, and the number of high-severity vulnerabilities decreased for the fourth consecutive year. The number classified as "high severity" as reported by the company has declined since 2010.
    11 - Vulnerability Disclosures Decrease in Severity
 
 
 
 
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date
Rocket Fuel