Perimeter
9/24/2010
05:15 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

'Here You Have' A Lesson

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.1. The security community is nimble. The server hosting the malicious download was shut down within just a few hours of the worm's initial spread. With no ability to infect new victim machines, the email component quickly self-destructed. As a result, 79% of the attempted click-throughs happened within the first three hours of the worm's initial propagation.

2. Proper heuristics do work. Some vendors -- including Cisco -- successfully identified and blocked the worm from the very beginning, no signatures required.

3. The majority of users have learned not to click on unexpected links. In the end, the "Here You Have" email accounted for only 0.3% of Web-delivered malware during a 30-day period. And from a vertical perspective, all industry employees clicked through at the same median rate. Indeed, month over month message-driven social engineering attacks collectively account for only 3% of Web-delivered malware; "Here You Have" didn't nudge this volume.

Despite this, many failed to accurately contextualize the threat posed by the "Here You Have" email and made it seem bigger than it was. As a result, reports of the worm far surpassed the actual spread of the worm itself --- even making national news broadcasts in the U.S.

So why is overstating the risk posed by a particular bit of malware a bad idea? After all, if it promotes security awareness, that's a good thing, right? Maybe not. One problem is that it causes many to equate all malware with something that is highly visible and garners massive amounts of attention. Yet it's the down-and-low, under-the-radar threats that are far more insidious.

Perhaps worse, positioning a threat as more widespread than it really is lends the impression that none of our security controls are working. And that's unfortunate. Because as we can see from the "Here You Have" example, the proper security controls do work -- even for that 99.7% of attacks that don't make the 6 o'clock news.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

CVE-2014-3543
Published: 2014-07-29
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity referenc...

CVE-2014-3544
Published: 2014-07-29
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.

CVE-2014-3545
Published: 2014-07-29
Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.