Vulnerabilities / Threats
12/8/2009
03:42 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Cisco Security Report Sees Social Media Risk

Bad passwords, inconsistent patching, excessive information sharing, and outdated AV software are key ingredients in what Cisco calls a security "nightmare formula."

Lovers and haters of the color-coded Department of Homeland Security Advisory System can now extend their passions toward Cisco's Global ARMS Race Index, the networking giant's attempt to convey the state of cybersecurity using the color spectrum.

ARMS in this context stands for "Adversary Resource Market Share."

On a scale of green -- cyber attacks are barely noticeable -- to red -- the bad guys own the Internet and no connection can be trusted, Cisco's 2009 Annual Security Report paints the current online environment in a light orange hue. That's 7.2 on a scale of 1 to 10 for those who prefer numbers to a continuum of color.

Cisco characterizes the situation thus: "Enterprise networks are experiencing persistent infections. Consumer systems are infected at levels capable of producing consistent and alarming levels of service abuse."

Cisco does its best to find some rays of hope amid the gloom. It notes that vendors are patching like mad. That's a bit like crowing about the number of combat medics in the field during a war.

From September through October 2009, Adobe, Cisco, Microsoft, and Oracle "released updates to patch more than 100 vulnerabilities in their respective products," the report says. Not only that but a vulnerability exploited by the Conficker botnet was patched and both Firefox and Internet Explorer received security upgrades.

But as far as good news goes, that's pretty anemic.

Far more impressive is the bad news: While the number of vulnerabilities remained about the same in 2009 as it has been in recent years, "the exploit and attack threat levels increased by 57%."

Social media represents a particular trouble spot because people tend to trust communication from supposed social network friends. Based on data from Cisco's 4000-plus security customers, as much as 2% of all Web traffic for businesses comes from accessing social sites like Facebook, MySpace, and LinkedIn.

In the report, Christopher Burgess, a senior security advisor to Cisco's CSO, argues that while this may not seem like a lot, it underscores the need to educate employees about the risk arising from social network usage.

A case in point is the Koobface worm, which has plagued Facebook and Twitter, affecting as many as 3 million computers.

Cisco sees risk not only in social networks but in the technology that has arisen to support them: URL shortening services. "The problem with short URLs is that they eliminate the user's ability to read the real Web address and decide if a link is save to follow," the report states.

There's plenty more bad news: Cisco projects a 30% to 40% increase in spam volume in 2010 and the continued proliferation of online banking Trojans.

The report also notes that 1 out of every 3000 Flash files, 1 out of every 2000 JavaScript files, and 1 out 600 PDF files contain malware.

Of course for security companies, bad news is good for business.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7421
Published: 2015-03-02
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.

CVE-2014-8160
Published: 2015-03-02
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disall...

CVE-2014-9644
Published: 2015-03-02
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-201...

CVE-2015-0239
Published: 2015-03-02
The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYS...

CVE-2014-8921
Published: 2015-03-01
The IBM Notes Traveler Companion application 1.0 and 1.1 before 201411010515 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by c...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.