Perimeter
9/24/2010
05:15 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

'Here You Have' A Lesson

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.1. The security community is nimble. The server hosting the malicious download was shut down within just a few hours of the worm's initial spread. With no ability to infect new victim machines, the email component quickly self-destructed. As a result, 79% of the attempted click-throughs happened within the first three hours of the worm's initial propagation.

2. Proper heuristics do work. Some vendors -- including Cisco -- successfully identified and blocked the worm from the very beginning, no signatures required.

3. The majority of users have learned not to click on unexpected links. In the end, the "Here You Have" email accounted for only 0.3% of Web-delivered malware during a 30-day period. And from a vertical perspective, all industry employees clicked through at the same median rate. Indeed, month over month message-driven social engineering attacks collectively account for only 3% of Web-delivered malware; "Here You Have" didn't nudge this volume.

Despite this, many failed to accurately contextualize the threat posed by the "Here You Have" email and made it seem bigger than it was. As a result, reports of the worm far surpassed the actual spread of the worm itself --- even making national news broadcasts in the U.S.

So why is overstating the risk posed by a particular bit of malware a bad idea? After all, if it promotes security awareness, that's a good thing, right? Maybe not. One problem is that it causes many to equate all malware with something that is highly visible and garners massive amounts of attention. Yet it's the down-and-low, under-the-radar threats that are far more insidious.

Perhaps worse, positioning a threat as more widespread than it really is lends the impression that none of our security controls are working. And that's unfortunate. Because as we can see from the "Here You Have" example, the proper security controls do work -- even for that 99.7% of attacks that don't make the 6 o'clock news.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.