[ insider_reports_insider ]
Attackers Winning The Hacking War
David Utter
Staff Writer
2006-08-11
 Insider Reports RSS Feed
Enhanced tools for exploiting flaws in computer systems have been growing in sophistication, and there is a concern that they are ahead of what the good guys have in their toolboxes.
 | | Losing the Fight Against Hackers |  |
It takes time for investigators to figure out how an exploit on a system worked, and how to fix it. Dr. Dobb's Journal reported on a talk at the Black Hat conference by security consultant Kevin Mandia on the arms race between malicious hackers and those who oppose their efforts.
Right now, it looks like the black hats are winning. Mandia claimed investigations into attacks take between 5 and 8 days on average to find the problematic code being used. He attributed this to an increase in sophistication in the tools being used to craft the attacks.
The Metasploit Project developed by HD Moore represents an example of one of these tools. Although the site notes "the tools and information on this site are provided for legal security research and testing purposes only," Metasploit definitely has some fans in the cracking community.
Another example of the speed with which attackers are hitting exploits became news when the Department of Homeland Security advised PC users to get one particular Windows issue patched as quickly as possible.
Even though information about the vulnerability had only been available from Microsoft for a day, security researchers discovered exploit code for the flaw in the wild.
Mandia singled out a particular web technology for special attention. During his talk, Mandia said he was seeing more attacks via Active Server Pages that had been developed to run on top of a compromised web server.
Accessing these pages gives the attacker carte blanche to a visiting PC. Mandia said of ASP that "it's like having an executable on a machine."
---
Tag: General
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
