eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Ive written many columns arguing that things are getting better for the average user over time, and I still feel that way. Its not just that the tools to protect yourself against attacks are becoming more accessible and affordable. The pattern of attacks by the malicious code crowd has changed.
Remember the widespread mass-mailer attacks of years ago? Those attacks are still out there and will be for a long time, but I doubt theyre infecting many new systems these days. And the mass network worm attacks like Sasser and Blaster are still in the background, but patched long ago, and no new vulnerabilities have emerged for a long time to allow such attacks.
In the meantime, defenses have shored up, especially in business. Effective network-level protection is cheap compared to the risks of not using it. Even a simple NAT box blocks a huge percentage of threats.
The pattern we began to see emerging in 2006 was the narrow, targeted attack. The old style of mass-bombardment of attacks appears to be a thing of the past. Its been over a year since we had a major Windows attack, Zotob if I remember correctly, and even that was not an all-timer. Even though it got a lot of ink, I still dont consider the WMF bug of a year ago to have been a major attack.
Zotob used the MS05-039 Plug-and-Play buffer overflow vulnerability to spread. There have been Windows vulnerabilities since then, but no widespread attacks based on them.
Instead a new pattern has emerged: Shortly after the monthly patch day, new zero-day attacks are discovered. Not widespread attacks, but narrowly targeted attacks against specific enterprises. A blog entry from Microsofts Security Response Center says that in the cases where they say that theyre aware of “very limited, targeted attacks,” they are talking about a few, perhaps as few as one or two.
Next page: Vulnerabilities for hire
Vulnerabilities for Hire
Roger Thompson, who built PestPatrol and is now doing other work in testing and development, recognized the pattern a year ago with the WMF vulnerability: Black hat researchers develop new vulnerabilities and sell them to exploiters with an embargo date, meaning they cant be used before that date, which is probably on or shortly after patch day.
In 2006 the most prominent of these vulnerabilities have been in Microsoft Office applications. There have been scores of other vulnerabilities in less-important programs, and perhaps some of these were for hire as well. If youre going to target a small number of networks, an obscure program might be adequate.
There are some important caveats about these vulnerabilities: They are usually addressable by anti-virus programs without a patch of the underlying vulnerability, and they almost always require a social engineering breach to get through.
The anti-virus protection is generally not valuable to the victims of the “very limited, targeted attacks” this is why so many experts have been grumbling about the “death” of the signature-based AV approach lately. But it is valuable to the rest of us because it limits the effective life span of the attacks. And there are many products that attempt to block unknown attacks through a variety of approaches.
The social engineering aspect is an unfortunate constant in security. If you can fool people into performing dangerous actions, you can gain at least some level of access. And when youre targeting a small number of networks, its not hard to imagine an e-mail spoofed to look like its coming from some senior exec to other addresses scraped off of the companys Web site. Its probably not hard to get through to at least a few users. Even so, its still not clear how many of the attacks are successful.
So there are still problems, but your likelihood of being attacked has gone down. Your ability to defend yourself has also gone up. You can expect things to change over the next year, as they always do, to adjust to conditions. For instance, if the “patch day=zero day” pattern continues, Microsoft may have to adjust its strategies.
Perhaps patches could move to a more frequent schedule. My moneys on a general tightening of policies to block attacks.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. He can be reached at [email protected].
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.