Browser Vulnerabilities Proliferate In First Half 2008

The X-Force research and development team research and monitor the latest threat trends, and help advise customers and the general public on how to respond to emerging and critical threats. The practice of disclosing exploit code along with a security advisory has been the accepted practice for many security researchers.

However, according to the X-Force report, vulnerabilities disclosed by independent researchers are twice as likely to have zero-day exploit code published, calling into question how researchers practice vulnerability disclosure and signifying the need for a new standard in the industry.

“The two major themes in the first half of 2008 were acceleration and proliferation,” said X-Force Operations Manager Kris Lamb.

“We see a considerable acceleration in the time a vulnerability is disclosed to when it is exploited, with an accompanying proliferation of vulnerabilities overall. Without a unified process for disclosing vulnerabilities, the research industry runs the risk of actually fuelling online criminal activity.

“There’s a reason why X-Force doesn’t publish exploit code for the vulnerabilities we have found, and perhaps it is time for others in our field to reconsider this practice.”

Key findings from the X-Force report included:

• Browser plug-ins are the newest target-of-choice. The threat landscape has evolved from the operating system to the Web browser to browser plug-ins. In the first six months of 2008, roughly 78% of web browser exploits targeted browser plug-ins.
• One-off manual attacks are growing into massive automated attacks. More than half of all vulnerability disclosures were related to web server applications. Structured Query Language (SQL) injection vulnerabilities, in particular, jumped from 25% in 2007 to 41% of all web server application vulnerabilities in the first half of 2008, and corresponded with a rash of automated attacks that compromised servers in an effort to compromise more endpoint systems.
• Spammers go back to basics. The complex spam of 2007 (image-based spam, file attachment spam, etc) has almost disappeared and now spammers are using simple URL spam. This spam generally consists of a few simple words and a URL, making it difficult for spam filters to detect. Approximately 90% of spam is now URL spam.
• Russia continues to be origin of most spam. Russia is responsible for 11% of the world’s spam followed by Turkey with 8% and then the United States with 7.1%.
• Online gamers are targets. As online games and virtual communities continue to gain popularity, they are becoming an enticing target for cybercriminals. The X-Force report indicates that the top four password-stealing Trojans were all aimed at gamers. The goal is to steal gamers’ virtual assets selling them for real money in online market places.
• Financial institutions remain key targets for phishers. All but two of the top 20 phishing targets were financial institutions.
• Secure virtualisation grows in importance. Virtualisation-related vulnerability disclosures have tripled since 2006 and are likely to increase as virtualised environments become more widespread.