Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/23/2017
08:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Data Breach, Vulnerability Data on Track to Set New Records in 2017

There are so far 1,254 publicly reported data breaches and 4,837 published vulnerabilities in the first quarter of this year.

Enterprise security executives looking for metrics to justify their budgets to top management should have plenty of material to choose from for the rest of year.

Two reports from Risk Based Security this week show that numbers related to data breaches and software vulnerabilities look set to break new records in 2017, if first quarter trends are any indication.

Risk Based Security's analysis of Q1 data showed there were a total of 1,254 publicly reported data breaches worldwide, which together exposed a mind-boggling 3.4 billion records containing sensitive data.

Two breaches alone accounted for over 2.5 billion of those breached records. One involved River City Media and exposed 1.34 billion email addresses while the other at Chinese Internet Service Provider NetEase Inc. exposed nearly 1.3 billion email addresses and passwords that were later sold on the Dark Web.

On the vulnerability front, Risk Based Security's VulnDB database published a total of 4,837 vulnerabilities in the first quarter of 2017. That number was 29.2% higher than the number of discovered vulnerabilities in the same quarter in 2016 and some 2,274 more than the vulnerabilities in the widely used National Vulnerability Database (NVD).

More than 35% of the flaws already had publicly available exploits or there was enough information about them to make the flaws trivially exploitable, according to Risk Based Security. Over 50% of the disclosed software flaws were remotely exploitable while 18% had a severity rating of 9 or above on an ascending scale of 1 to 10.

The numbers are sobering and suggest that 2017 is well on its way to becoming the worst year on record for data breaches and software vulnerabilities. For all of 2016 for instance, data breaches exposed 4.2 billion records compared to the 3.4 billion in this year's first quarter alone.

The number of extremely large datasets that have been exposed so far this year or offered for sale in particular is surprising, says Inga Goddijn, executive vice president at Risk Based Security.

"After last year's disclosure at Yahoo, we thought it would be a long time before we saw another breach exposing over 1 billion records," she says. Surprisingly, there were two events in Q1 that exposed over one billion records.

The same widespread phishing and business email compromise activity that drove breach numbers in 2016 is fuelling the trend this year as well, according to Risk Based Security. Many of the phishing campaigns have targeted data in W-2 forms for the purposes of carrying on tax fraud.

But as massive as the data breach numbers are, the overall severity of data breaches has not gotten significantly worse.

"While there were a number of surprisingly large breaches, the overall severity of breach events remains steady," Goddijn says. Risk Based Security assigns severity scores based on the number of records that were exposed in a breach, the type of data that was involved, the breached industry, and other factors.

"Approximately 45% of reported breaches impacted somewhere between one and 10,000 records and the majority of breaches score below a 6 on our severity scale of 0.01 to 10," in terms of type of data exposure and impact. "It is encouraging to see severity scores staying relatively steady, indicating overall breach severity is not increasing," Goodign says.

Significantly, nearly 18% of the reported data breaches in the first quarter of 2017 had unknown origins. An unknown breach, says Goodijn, is one where the organization responsible for a data leak cannot be identified at the time of the compromise. "This tends to happen when data is leaked and the persons doing the leaking does not identify the data source or when there is a business relationship between the party responsible for the compromise and the party disclosing the breach," she says.

Jake Kouns, the chief information security office and chief operating officer at Risk Based Security, says a lot of the vulnerabilities discovered in products stem from a lack of mature software development practices at many organizations.

"Of all the vulnerabilities disclosed in Q1 2017, 68.1% are due to insufficient or improper input validation," Kouns says. "While a lot of vulnerabilities fall under this umbrella, including cross-site scripting, SQL injection, shell command injection, and buffer overflows, it underlines that vendors still struggle to carefully validate untrusted input," he says.

Web-related flaws accounted for nearly 60% of publicly disclosed vulnerabilities in Q1 2017. Of this, 30% were SQL injection errors.

Risk Based Security's vulnerability count includes flaws in the National Vulnerability Database that have an assigned CVE number attached to them as well as vulnerabilities for which no CVEs are yet available. Contrary to popular perception, the lack of a CVE number does not automatically mean a vulnerability is not serious or effects only obscure products, Risk Based Security said.

Overall, products from major vendors accounted for 31.1% of the vulnerabilities reported in Q1 2017, Kouns says.

Topping the list of companies with the most publicly reported vulnerabilities in its products was Oracle with 369 security vulnerabilities across its software portfolio. Google, which often makes a big deal about flaws in software from other vendors, came in second with 302 reported security vulnerabilities, while Microsoft took third spot with 204.

Adobe topped the list from a vulnerability severity standpoint. The 100 vulnerabilities that were discovered in its products in the first quarter had an average severity rating of 8.84 compared to 6.05 for Oracle's vulnerabilities and 6.62 for Microsoft's software flaws. Google ranked second with security vulnerabilities in its products, having an average vulnerability severity score of 7.1.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23836
PUBLISHED: 2021-01-15
An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The...
CVE-2021-23837
PUBLISHED: 2021-01-15
An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to be accepting malicious...
CVE-2021-23838
PUBLISHED: 2021-01-15
An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious user...
CVE-2020-35581
PUBLISHED: 2021-01-15
A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the meta[title] parameter.
CVE-2020-35582
PUBLISHED: 2021-01-15
A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the post_title parameter.