Businesses face new breed of security threats
Published: 10 Apr 2008 09:20 BST
"Pass the hash" and "metasploit" are two of a breed of emerging security threats facing corporate IT departments.
The key security threats facing businesses range from mutations of established phenomena — such as malware or phishing — to less well-known ones, such as metasploit releases and pass-the-hash attacks.
The most dangerous new security threats were revealed by experts at the RSA security conference in San Francisco this week.
Ed Skoudis, a hacking expert at the Sans Institute, said most security threats stem from the fact that so many applications are now linked to the internet.
He said: "We've web-ified all applications."
Among the less familiar new threats are metasploit releases, which target networks by simultaneously attacking a number of vulnerabilities (up to 200) on different platforms, including Windows, Linux and the iPhone.
Pass-the-hash attacks, which use stolen password hashes to access other systems in a targeted network — avoiding more time-consuming password-cracking — were also singled out.
Although this approach has been around for some time, it is only now that it's becoming prevalent. Skoudis said: "These attacks have been around for years but now the tools are out there."
Read this
Corporate espionage: Not if, but when
When it comes to business-to-business theft of information, experts agree — it's best to assume it will happen to your company
Website attacks, which plant browser exploits to compromise users, are also becoming more of a problem, as they are able to target well-known, high-traffic sites.
A major threat is browser scripting attacks, which use web browsers to get through corporate firewalls, allowing access to confidential information.
While not a new threat, the development of botnets remains a big security concern because the "fast flux" approach used by attackers to protect their robotic networks is making the life of botnet investigators difficult.
The security experts also warned about the threat of malware being spread through the use of embedded devices, such as memory sticks — now one of the main ways harmful code is brought into businesses.
Credit: Security threats revealed: Beware the metasploit from silicon.com
- Blog: Social networking and portability
- ICO: Data-protection spot checks due this year
- Infosecurity Europe 2008: Preview
- Security breaches down, says IT security report
- Facebook admits to increased attacks by spammers
- Security industry gears up for biggest UK event
- Vendors urged to take responsibility for security
- Media lobbying 'watered down' data-misuse laws
- HMRC data loss blamed on targets
- Former White House adviser talks mobile threats
- Security expert voices virtualisation concerns
- Lord: No proof any data was lost from HMRC
Did you find this article useful?
6 out of 6 people found this useful
- Share this article:
