It’s no secret that attackers use trusted applications to stealthily launch threats into organizations.
A recent example is the November 2014 attack on Forbes.com where the attacker used two chained zero-day Adobe Flash and Internet Explorer (IE) vulnerabilities hosted on the Forbes.com website to create a watering hole targeting users in financial services industries. Visitors to the exploited page using IE 9+ browsers with the Flash plugin enabled inadvertently downloaded a malicious .SWF file, which allowed attackers to gain control over the victim’s machine. The attack was discovered by Invincea’s threat research team.
Another example, discovered by Alien Vault Labs, occurred in August 2014. Attackers used what was likely a cross-site scripting (XSS) vulnerability on an industrial company’s web site to load Scanbox on to victims’ machines to collect information about what software the machines were running and sent that information back to the attacker.
In the examples above, three different applications were leveraged: Adobe Flash, Internet Explorer, and a web application (web page). These aren’t just occasional occurrences, either. Sujata Ramamoorthy, Cisco’s Director of Information Security, estimated that more than 70 percent of attacks leverage application vulnerabilities.
Thought Experiment: An App-Perfect World
For a second let’s imagine a world where all applications were 100 percent secure all of the time. What would this mean for the world of cybercrime? For starters, it would mean that cybercriminals would be much more hard-pressed in finding ways to attack users and organizations, drastically decreasing not only the ways in which a profit could be earned through cyber crime, but also the amount of profit gained from a successful attack. The extra work involved to find a way to compromise the application would have a negative impact on the criminal organization’s bottom line, which could lead to cuts in funding for attack research and staff.
Making it more difficult (and thus more expensive) to launch a successful attack means fewer attackers and fewer attacks. At the end of the day, hackers have to pay the bills, too. Sure, there would still be armies of nation-state hackers and guys who won’t accept defeat and opt to spend their free time hammering out new attack methods, but the threat landscape would change — drastically, and for the better.
Back to Reality
Of course, I know a world with totally secure applications is just a fantasy. However, that doesn’t mean we are helpless to better protect ourselves against application-borne threats. So, how do you make the applications you’re using or creating more secure and resilient?
- Use secure coding practices and stringent security testing procedures throughout the software development lifecycle to ensure that your application cannot be used maliciously…
This means making sure applications are architected with security as a priority, right next to functionality, and testing every version or iteration of the software during development, QA, staging, and production. It sounds exhausting, but it’s less exhausting than having to scramble after hemorrhaging customers due to an unpatched production vulnerability that led to a security incident or data breach.
…and taking additional precautions even after the code goes live through patching and tools like web application firewalls and intrusion prevention systems.
Even after thorough testing procedures, a web application firewall or intrusion prevention system can help to block potential evil-doers from combing through applications for attack vectors by alerting on or blocking host sweeps and port scans. In addition to ensuring that your applications aren’t serving up easily-exploited vulnerabilities, these tools also help identify and thwart internal and external users who attempt to access restricted resources or search for potential vulnerabilities.
- Architect your network so that all traffic and applications on all ports and protocols — including those that use SSL encryption — are visible and void of threats, and data remains secure.
This has to do more with the Zero Trust methodology. Make it incredibly time-consuming and expensive for cybercriminals to target you. Know which applications are being used and what kinds of risks they introduce, and then try to reduce the impact of those risks by limiting the use of unsecured features within those applications, controlling which of your users has access to those application features, and segmenting and securing data to which those applications have access.
Gaining complete visibility into the applications traversing your network and controlling the way users are able to interact with them is paramount to preventing threats that leverage them to access the network. This is a large part of the premise behind the multitude of “next-generation” security products currently on the market: that they can identify traffic and classify it within the context of applications. If you can tie traffic to applications and allow only certain applications onto the network, then you’ve reduced your security risk. If you can then focus on securing potential attack vectors within those applications, real prevention becomes possible.