Perimeter
9/24/2010
05:15 AM
Commentary
Commentary
Commentary
50%
50%

'Here You Have' A Lesson

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.

It's been interchangeably called spam, or a targeted attack that spun out of control, or a form of cyber-jihad with alleged geopolitical implications. But regardless of what you call it, the "Here You Have" email worm is an excellent example of just how well today's security can work. Here are a few justifications for that optimism.1. The security community is nimble. The server hosting the malicious download was shut down within just a few hours of the worm's initial spread. With no ability to infect new victim machines, the email component quickly self-destructed. As a result, 79% of the attempted click-throughs happened within the first three hours of the worm's initial propagation.

2. Proper heuristics do work. Some vendors -- including Cisco -- successfully identified and blocked the worm from the very beginning, no signatures required.

3. The majority of users have learned not to click on unexpected links. In the end, the "Here You Have" email accounted for only 0.3% of Web-delivered malware during a 30-day period. And from a vertical perspective, all industry employees clicked through at the same median rate. Indeed, month over month message-driven social engineering attacks collectively account for only 3% of Web-delivered malware; "Here You Have" didn't nudge this volume.

Despite this, many failed to accurately contextualize the threat posed by the "Here You Have" email and made it seem bigger than it was. As a result, reports of the worm far surpassed the actual spread of the worm itself --- even making national news broadcasts in the U.S.

So why is overstating the risk posed by a particular bit of malware a bad idea? After all, if it promotes security awareness, that's a good thing, right? Maybe not. One problem is that it causes many to equate all malware with something that is highly visible and garners massive amounts of attention. Yet it's the down-and-low, under-the-radar threats that are far more insidious.

Perhaps worse, positioning a threat as more widespread than it really is lends the impression that none of our security controls are working. And that's unfortunate. Because as we can see from the "Here You Have" example, the proper security controls do work -- even for that 99.7% of attacks that don't make the 6 o'clock news.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.