Perimeter
9/24/2010
05:15 AM
Commentary
Commentary
Commentary
50%
50%

'Here You Have' A Lesson

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.1. The security community is nimble. The server hosting the malicious download was shut down within just a few hours of the worm's initial spread. With no ability to infect new victim machines, the email component quickly self-destructed. As a result, 79% of the attempted click-throughs happened within the first three hours of the worm's initial propagation.

2. Proper heuristics do work. Some vendors -- including Cisco -- successfully identified and blocked the worm from the very beginning, no signatures required.

3. The majority of users have learned not to click on unexpected links. In the end, the "Here You Have" email accounted for only 0.3% of Web-delivered malware during a 30-day period. And from a vertical perspective, all industry employees clicked through at the same median rate. Indeed, month over month message-driven social engineering attacks collectively account for only 3% of Web-delivered malware; "Here You Have" didn't nudge this volume.

Despite this, many failed to accurately contextualize the threat posed by the "Here You Have" email and made it seem bigger than it was. As a result, reports of the worm far surpassed the actual spread of the worm itself --- even making national news broadcasts in the U.S.

So why is overstating the risk posed by a particular bit of malware a bad idea? After all, if it promotes security awareness, that's a good thing, right? Maybe not. One problem is that it causes many to equate all malware with something that is highly visible and garners massive amounts of attention. Yet it's the down-and-low, under-the-radar threats that are far more insidious.

Perhaps worse, positioning a threat as more widespread than it really is lends the impression that none of our security controls are working. And that's unfortunate. Because as we can see from the "Here You Have" example, the proper security controls do work -- even for that 99.7% of attacks that don't make the 6 o'clock news.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7421
Published: 2015-03-02
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.

CVE-2014-8160
Published: 2015-03-02
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disall...

CVE-2014-9644
Published: 2015-03-02
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-201...

CVE-2015-0239
Published: 2015-03-02
The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYS...

CVE-2014-8921
Published: 2015-03-01
The IBM Notes Traveler Companion application 1.0 and 1.1 before 201411010515 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by c...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.