Research on browser weaknesses triggers attacks

Jul 30, 2008

IBM's X-Force says cyber-criminals are using public research on Web browser weaknesses to launch attacks before most users are even aware of their vulnerability. The mid-year report from the security group indicates that organized criminals are adopting new automated techniques and strategies that allow them to exploit vulnerabilities much faster than ever before.

According to the X-Force report, 94 percent of all browser-related online exploits occurred within 24 hours of a vulnerability being officially disclosed. These attacks, known-as "zero-day" exploits, are on the Internet before people even know they have a vulnerability that needs to be patched in their systems.

Many security researchers have routinely posted the code needed to exploit a weakness as part of a security advisory. According to the X-Force report, these disclosed vulnerabilities are twice as likely to trigger zero-day exploits.

"The two major themes in the first half of 2008 were acceleration and proliferation," said X-Force Operations Manager Kris Lamb. "We see a considerable acceleration in the time a vulnerability is disclosed to when it is exploited, with an accompanying proliferation of vulnerabilities overall. Without a unified process for disclosing vulnerabilities, the research industry runs the risk of actually fueling online criminal activity. There's a reason why X-Force doesn't publish exploit code for the vulnerabilities we have found, and perhaps it is time for others in our field to reconsider this practice."

The latest X-Force report also found that browser plug-ins are the newest target-of-choice. In the first six months of 2008, roughly 78 percent of web browser exploits targeted browser plug-ins.

For more security trends and predictions from IBM, including graphical representations of security statistics, please access the full report at: www.ibm.com/services/us/iss/xforce/midyearreport

Provided by IBM

Explore further: Premier US album chart revamped to include streaming

add to favorites email to friend print save as pdf

Related Stories

Form Devices team designs Point as a house sitter

4 hours ago

A Scandinavian team "with an international outlook" and good eye for electronics, software and design aims to reach success with what they characterize as "a softer take" on home security. Their device is ...

Man pleads guilty in New York cybercrime case

7 hours ago

A California man has pleaded guilty in New York City for his role marketing malware that federal authorities say infected more than a half-million computers worldwide.

NASA issues 'remastered' view of Jupiter's moon Europa

15 hours ago

(Phys.org) —Scientists have produced a new version of what is perhaps NASA's best view of Jupiter's ice-covered moon, Europa. The mosaic of color images was obtained in the late 1990s by NASA's Galileo ...

Dish restores Turner channels to lineup

16 hours ago

Turner Broadcasting channels such as Cartoon Network and CNN are back on the Dish network after being dropped from the satellite TV provider's lineup during contract talks.

Recommended for you

YouTube goes online for second Music Awards

Nov 20, 2014

The YouTube Music Awards are undergoing an overhaul for their second edition next year, scrapping a star-studded gala and instead looking at videos' online buzz.

China Premier calls for greater role in shaping Web

Nov 20, 2014

Chinese Premier Li Keqiang Thursday demanded a greater role for Beijing in shaping the global Internet, calling for "order" online as he failed to address his government's censorship of content it deems politically ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.