Increasing Problem: 'Bot Storming,' 'Google Hacking' Hit Web Apps TelecomWeb
Cyber-security vendor Fortify Software Inc. says it's completed a research and survey study on Internet vulnerability risks, detailing an increasing series of new and emerging attacks specifically targeting Web-based applications. The San Francisco-based company says it's collected data from a number of its customers during a six-month period to identify at least four of today's most imminent cyber threats, including so-called "bot storming" and "Google hacking" as well as a variety of "directed attacks" and attacks from a wide range of global sources. Fortify's work buttresses growing concerns and actions over cyber security - attributable to criminal activity, possible terrorism and simple mischievousness - seen among government and enterprise organizations. This includes a U.S. Department of Homeland Security (DHS) sweeping national infrastructure protection plan (NIPP), a series of Business Roundtable suggestions on greater public/private sector coordination, warnings from a Century Foundation think-tank task force chaired by former national counter-terrorist advisers Richard A. Clarke and Rand Beers, and U.S. law enforcement's backing of a new Center for Identity Management and Information Protection (CIMIP) at Utica College in Utica, N.Y. According to Fortify, bot storming (automated probes or networks searching for unprotected or unpatched components of Web apps) accounted for more than half of the attacks that were researched; it said probes of this type can be negligible or catastrophic (depending on the way Web apps are built), and they can be forerunners to Internet worms and directed attacks. Google hacking (accessing Web-site information stored in search engine indices) accounted for more than 20 percent of all security events in the company's research monitoring pool; it said Web apps may automatically report diagnostic information if a Web page is broken, allowing hackers to use information stored in search-engine indices of those sites to map out an application's components and internal structure. Fortify says directed attacks are less frequent, but they are much more sophisticated and dangerous to specific Web apps, with hacker techniques using cross-site scripting, structured query language (SQL) injection and buffer overflow doing the damage. In addition, the company says it's examined an increasingly global attack base, finding a wide range of recent attack-origination points in the United States, China, Poland and Australia. It also warns that so-called "anonymizing" technologies and proxy servers continue to mask the true locations of Web apps attack sources, reflecting their "invisible" nature. "There is a wealth of research covering viruses, network-based attacks, public vulnerability announcements, spam and phishing schemes, but very little focusing on Web-enabled applications that sit beyond the reach of firewalls and traditional network security," says Brian Chess, Fortify's chief scientist. "With today's consumers and businesses depending on Web applications, such as e-commerce and financial services applications that contain sensitive customer information, it's critical that businesses understand the risk exposure of their applications and take the necessary steps to avoid dangerous security attacks." Phishing techniques generally instruct recipients to click a link in fake versions of e-mail from known senders - to confirm personal information - but they actually link to bogus sites that are able to steal data. At this time, there also is a great deal of cyber-security attention being paid to laptops with remote communications capability, vulnerable to real-time interceptions. ------------------------------------------------------------------- Duane Whittingham (N9SSN) - Producer Tom and Darryl Radio Shows & Saturday Morning Confusion Heard on C-Band Analog Satellite (W0KIE) - Telstar 6 Ch 1 - 6.2/6.8 WTND-LP Macomb 106.3, WQNA FM, WBCQ 7415 kHz & the Internet. Heard Fridays 9pm ET, Sundays 12am ET and Tuesdays 2am ET (Folk) An Independent Freeform Eclectic Radio Show. http://www.tomanddarryl.org http://www.wtnd.us Reply with a "Thank you" if you liked this post. _____________________________ MEDIANEWS mailing list [email protected] To unsubscribe send an email to: [EMAIL PROTECTED]
