Malicious Activity Skyrocketing on the Net

The amount of malicious activity on the Internet is increasing at a frightening rate and shows no signs of slowing down anytime soon.

2001 marked the third consecutive year that the number of security incidents handled by the CERT Coordination Center doubled compared with the previous year. The center, based at Carnegie Mellon University in Pittsburgh and partially funded by the federal government, responded to a total of 52,658 security incidents in 2001, compared with 21,756 in 2000.

Last year also saw a dramatic increase in the number and seriousness of software vulnerabilities reported to CERT. According to year-end statistics released Friday, the center received word of 2,437 flaws, up from 1,090 in 2000. Of that number, 326, or 13 percent, were serious enough that CERT staff published notes warning the public of the problem. In 2000, the center published advisories on just 4 percent of all of the vulnerabilities it logged.

The last year was a particularly bad one for software vulnerabilities, and not just from a raw numbers standpoint. In the last 12 months researchers discovered several major flaws in the BIND software that runs the vast majority of the Internets domain-name servers; a serious vulnerability in Microsoft Corp.s Internet Information Server Web server that was later used by the devastating Code Red worms; and a buffer overflow in the Universal Plug and Play service in Windows XP that enables an attacker to gain total control of a vulnerable machine.

CERT has been keeping its statistics since 1988, when it responded to just six incidents and released one security alert. By 1995, when commercial use of the Internet in the form of the World Wide Web really began to take off, CERT received more than 2,400 incident reports. That total looks paltry in retrospect, given that it has increased more than 21-fold in the past six years.

Part of the dramatic increase in the number of security incidents can be attributed to the ever-increasing number of people on the Internet, CERT officials said.

“Part of it is that there are more people online,” said Chad Dougherty, Internet security analyst at CERT. “Slowly, but surely more people are becoming aware of security practices, and so we have more people looking for vulnerabilities and potential for incidents. Some of the really large-scale incidents like Code Red this year really drove home the seriousness of the problem.”