Unpatched applications on Web servers, clients are weakest links in cybersecurity

Hackers — whether criminal or apparent agents of foreign governments — are exploiting unpatched applications on Web servers and client computers to infect entire networks, according to report released today on predominant cybersecurity risks.

“Attackers have long picked up on this opportunity and have switched to different types of attacks in order to take advantage of these vulnerabilities, using social engineering techniques to lure end-users into opening documents received by e-mail or by infecting Web sites with links to documents that have attacks for these vulnerabilities embedded,” according to the Top Cyber Security Risks list, released today by the SANS Institute.

On average, major organizations being monitored by Qualys, a company that provides patch-management services, take at least twice as long to patch client-side application vulnerabilities as operating-system vulnerabilities, the report states. This can leave client computers open to targeted attacks delivered via socially engineered e-mail.

“Waves of targeted e-mail attacks, often called 'spear phishing,' are exploiting client-side vulnerabilities in commonly used programs such as Adobe PDF Reader, QuickTime, Adobe Flash and Microsoft Office,” the report states. “This is currently the primary initial infection vector used to compromise computers that have Internet access.”

These targeted attacks are the primary threat faced by government organizations and by top executives with access to sensitive data, said Rob Lee of Mandiant, an incident-response company and the SANS faculty leader in forensics.

“They predominantly use spear-phishing attacks which they have socially engineered” to deliver client-side application exploits, Lee said. He called the threats advanced and persistent. “These are not hobbyists who are doing this. There’s a big payoff here.”

But the same client applications are being exploited by malicious code that is delivered by trusted third-party Web sites. These Web sites frequently host publicly posted content but have been compromised, often by SQL injection techniques.

“Despite the enormous number of attacks and despite widespread publicity about these vulnerabilities, most Web site owners fail to scan effectively for the common flaws and become unwitting tools used by criminals to infect the visitors that trusted those sites,” the report states.

Whatever the delivery mechanism being used, a successful attack against a client computer can give the attacker a foothold within an organization.

“Once the client gets exploited, the attack pivots through the organization,” ultimately giving access to servers housing sensitive data, noted Ed Skoudis, who works with the Internet Storm Center, in comments on the release of the report.

The report urged organizations to better protect DMZ-based Web applications from SQL injection attacks and to pay more attention to keeping application patches up-to-date, even on clients that do not contain or have direct access to sensitive data. “There is no single silver bullet here,” Skoudis said. Attention must be paid to security at different locations to build up adequate layers of security.

The report was based on attack data gathered by TippingPoint from 6,000 organizations, in addition to vulnerability data from 9,000 organizations monitored by Qualys. The study was undertaken to update a list of the Twenty Critical Controls for Effective Cyber Defense, which is maintained by the Center for Strategic and International Studies.

The information included in the report is enlightening, said Alan Paller, SANS Institute's director of research.

“For the first time, they have taken the cover off the attack space and the vulnerability patch space, so you can see inside and see what is happening.”

The findings are not surprising, however. Cybersecurity vendors and industry organizations have been reporting the trend toward exploitation of applications rather than operating systems for several years.

“People heard about it, but they didn’t do anything about it,” Paller said. What the report provides that is new is specific data that should allow IT security professionals to focus priorities. “I think we failed because we didn’t prioritize. If you’re security people aren’t fixing these things, you have to get new security people.”

The patch cycle for applications now is much slower than for operating systems, with a decrease in the number of vulnerable systems of only about 20 percent over 60 days from the release of a patch, said Wolfgang Kandek, the top technologist at Qualys.

“Applications that are widely installed are not being patched at the same speed as operating systems,” Kandek said. The same tools often can be used to patch both applications and operating systems, he said. The reason they are not is cultural. “It is a fear of breaking the applications that makes the IT staff reluctant to patch the applications. It is critical for organizations to realize this is becoming an attack vector.”

The United States is overwhelmingly the top target for server-side HTTP attacks, the study found. “For years, attack targets in the United States have presented greater value propositions for attackers, so this statistic really comes as no surprise.” This country is also the overwhelming top source of such attacks.

The threats are being compounded by a growing pool of researchers who are discovering vulnerabilities before they are known to and fixed by application vendors, so called zero day vulnerabilities.

“The skill set of people who are discovering the vulnerabilities is sharper now than ever,” said Rohit Dhamankar, the top scientist at TippingPoint and a principal author of the report.

Unfortunately, the study found that this pool is growing faster among the bad guys than among the good guys. “There is a corresponding shortage of highly skilled vulnerability researchers working for government and software vendors,” he said. “So long as that shortage exists, the defenders will be at a significant disadvantage in protecting their systems against zero-day attacks.”