Risk
10/22/2012
03:17 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

FireHost Q3 Web Application Report -- XSS Attacks Lead Pack As Most Frequent Attack Type

FireHost categorizes four attack types, in particular, as representing the most serious threat

London, UK – October 22, 2012 – Secure cloud hosting company, FireHost, has today announced the findings of its latest web application attack report, which provides statistical analysis of the 15 million cyber-attacks blocked by its servers in the US and Europe during Q3 2012. The report looks at attacks on the web applications, databases and websites of FireHost's customers between July and September, and offers an impression of the current internet security climate as a whole.

Amongst the cyber-attacks registered in the report, FireHost categorises four attack types in particular as representing the most serious threat. These attack types are among FireHost's 'Superfecta' and they consist of Cross-site Scripting (XSS), Directory Traversals, SQL Injections, and Cross-site Request Forgery (CSRF).

One of the most significant changes in attack traffic seen by FireHost between Q2 and Q3 2012 was a considerable rise in the number of cross-site attacks, in particular XSS and CSRF attacks rose to represent 64% of the group in the third quarter (a 28% increased penetration). XSS is now the most common attack type in the Superfecta, with CSRF now in second. FireHost's servers blocked more than one million XSS attacks during this period alone, a figure which rose 69%, from 603,016 separate attacks in Q2 to 1,018,817 in Q3. CSRF attacks reached second place on the Superfecta at 843,517.

Cross-site attacks are dependent upon the trust developed between site and user. XSS attacks involve a web application gathering malicious data from a user via a trusted site (often coming in the form of a hyperlink containing malicious content), whereas CSRF attacks exploit the trust that a site has for a particular user instead. These malicious security exploits can also be used to steal sensitive information such as user names, passwords and credit card details – without the site or user's knowledge.

The severity of these attacks is dependent on the sensitivity of the data handled by the vulnerable site and this ranges from personal data found on social networking sites, to the financial and confidential details entered on ecommerce sites amongst others. A great number of organisations have fallen victim to such attacks in recent years including attacks on PayPal, Hotmail and eBay, the latter falling victim to a single CSRF attack in 2008 which targeted 18 million users of its Korean website. Furthermore in September this year, IT giants Microsoft and Google Chrome both ran extensive patches targeted at securing XSS flaws, highlighting the prevalence of this growing online threat.

"Cross-site attacks are a severe threat to business operations, especially if servers aren't properly prepared," said Chris Hinkley, CISSP – a Senior Security Engineer at FireHost. "It's vital that any site dealing with confidential or private user data takes the necessary precautions to ensure applications remain protected. Locating and fixing any website vulnerabilities and flaws is a key step in ensuring your business and your customers, don't fall victim to an attack of this nature. The consequences of which can be significant, in terms of both financial and reputational damage."

The Superfecta attack traffic for Q3 2012 can be broken down as follows:

As with Q2 2012, the majority of attacks FireHost blocked during the third calendar quarter of 2012 originated in the United States (11million / 74%). There has however, been a great shift in the number of attacks originating from Europe this quarter, as 17% of all malicious attack traffic seen by FireHost came from this region. Europe overtook Southern Asia (which was responsible for 6%), to become the second most likely origin of malicious traffic.

Varied trends among the Superfecta attack techniques are demonstrated between this quarter and last:

During the build up to the holiday season, ecommerce activity ramps up dramatically and cyber-attacks that target website users' confidential data are also likely to increase as a result. As well as cross-site attacks, the other Superfecta attack types, SQL Injection and Directory Transversal, still remain a significant threat despite a slight reduction in frequency this quarter.

Ecommerce businesses need to be aware of the risks that this period may present it to its security, as Todd Gleason, Director of Technology at FireHost explains, "You'd better believe that hackers will try and take advantage of any surges in holiday shopping. They will be devising a number of ways they can take advantage of any web application vulnerabilities and will use an assortment of different attack types and techniques to do so. When it's a matter of confidential data at risk, including customer's financial information – credit card and debit card details – there's no room for complacency. These organisations need to know that there's an increased likelihood of attack during this time and it's their responsibility to take the necessary steps to stop such attacks."

For more information, please visit: http://www.firehost.co.uk

About FireHost

FireHost is a secure cloud hosting company focused on protecting sensitive data and companies' brand reputations with infrastructure built for security, scalability and performance. Customers with specific compliance or performance needs subscribe to FireHost's PCI, HIPAA or high traffic solutions, including some of the largest companies in the world, as well as many fast growing eCommerce, SaaS and healthcare IT providers. FireHost provides services from Dallas, Phoenix, London and Amsterdam.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4725
Published: 2014-07-27
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVE-2014-4726
Published: 2014-07-27
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-2625
Published: 2014-07-26
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

CVE-2014-2626
Published: 2014-07-26
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.