Vulnerabilities / Threats
1/7/2011
03:21 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Tech Insight: Six Security Threats You Need To Know About

Security pros will have their hands full with revamped versions of current threats, while new ones also will bubble to the top

4. DLL Hijacking
One attack that resurfaced in 2010 was DLL hijacking. It has been called a couple of things, like binary planting or DLL preloading, but it has been a known issue for 10 years. What's interesting is that new research uncovered it as both an attack method for gaining control of a system and a method for malware to use as persistence. To make matters worse for security pros, new code released through the Metasploit Project made it incredibly easy to exploit. Microsoft has provided a few workarounds and fixes, but the issue has not been fixed fully because it affects many vendors. Exploit DB has been tracking vulnerable applications here.

5. Shodan
Shodan garnered a lot of attention last year when security researchers showed just how easy it was to find vulnerable systems on the Internet without scanning for them. With Shodan, they could leverage scans performed by someone else, and for a small cost export all of that data and feed it into their attack tools. Shodan's exposure of vulnerable SCADA devices was enough impetus for CERT to publish an advisory warning of the possible exposure. The popularity of the site for researchers and penetration testers will only help it grow further and end up exposing more services on systems worldwide that could be vulnerable. It's a reminder to many to know what's on your network and what's exposed to the world.

6. Embedded Systems
Embedded systems made their way to the spotlight as more attacks were focused on printers, smart meters, industrial control systems, and the like. The VxWorks vulnerabilities published in August demonstrated how easy it is to exploit fiber channel switches, printers, and SCADA devices that were easily found via Shodan. Of course, working with the vendor and understanding what, if any, network access these devices have is critical when deploying them because they could provide an easy entry point into your network.

The attacks that gained popularity in 2010 will stick around for a while; many are hard to fix or involve systemic issues that take more than technical workarounds to mitigate. And as always, staying up-to-date on the latest attacks is key. As a defender, you have to get it right every time, but an attacker needs to get it right only once.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web