Vulnerabilities / Threats
12/8/2009
03:42 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Cisco Security Report Sees Social Media Risk

Bad passwords, inconsistent patching, excessive information sharing, and outdated AV software are key ingredients in what Cisco calls a security "nightmare formula."

Lovers and haters of the color-coded Department of Homeland Security Advisory System can now extend their passions toward Cisco's Global ARMS Race Index, the networking giant's attempt to convey the state of cybersecurity using the color spectrum.

ARMS in this context stands for "Adversary Resource Market Share."

On a scale of green -- cyber attacks are barely noticeable -- to red -- the bad guys own the Internet and no connection can be trusted, Cisco's 2009 Annual Security Report paints the current online environment in a light orange hue. That's 7.2 on a scale of 1 to 10 for those who prefer numbers to a continuum of color.

Cisco characterizes the situation thus: "Enterprise networks are experiencing persistent infections. Consumer systems are infected at levels capable of producing consistent and alarming levels of service abuse."

Cisco does its best to find some rays of hope amid the gloom. It notes that vendors are patching like mad. That's a bit like crowing about the number of combat medics in the field during a war.

From September through October 2009, Adobe, Cisco, Microsoft, and Oracle "released updates to patch more than 100 vulnerabilities in their respective products," the report says. Not only that but a vulnerability exploited by the Conficker botnet was patched and both Firefox and Internet Explorer received security upgrades.

But as far as good news goes, that's pretty anemic.

Far more impressive is the bad news: While the number of vulnerabilities remained about the same in 2009 as it has been in recent years, "the exploit and attack threat levels increased by 57%."

Social media represents a particular trouble spot because people tend to trust communication from supposed social network friends. Based on data from Cisco's 4000-plus security customers, as much as 2% of all Web traffic for businesses comes from accessing social sites like Facebook, MySpace, and LinkedIn.

In the report, Christopher Burgess, a senior security advisor to Cisco's CSO, argues that while this may not seem like a lot, it underscores the need to educate employees about the risk arising from social network usage.

A case in point is the Koobface worm, which has plagued Facebook and Twitter, affecting as many as 3 million computers.

Cisco sees risk not only in social networks but in the technology that has arisen to support them: URL shortening services. "The problem with short URLs is that they eliminate the user's ability to read the real Web address and decide if a link is save to follow," the report states.

There's plenty more bad news: Cisco projects a 30% to 40% increase in spam volume in 2010 and the continued proliferation of online banking Trojans.

The report also notes that 1 out of every 3000 Flash files, 1 out of every 2000 JavaScript files, and 1 out 600 PDF files contain malware.

Of course for security companies, bad news is good for business.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

CVE-2014-3991
Published: 2014-07-11
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dol_use_jmobile, (2) dol_optimize_smallscreen, (3) dol_no_mouse_hover, (4) dol_hide_topmenu, (5) dol_hide_leftmenu, (6) mainmenu, or (7) leftmenu pa...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.