Application Vulnerabilities Are Not New

This morning I read the new @RISK: The Consensus Security Alert from SANS and friends. It begins with this comment:

"Prediction: This is the year you will see application level attacks mature and proliferate. As hackers focus more on applications, Oracle may start competing with Microsoft as the vendor delivering software with the most critical vulnerabilities."

I hear this focus on "applications" constantly, but this is old news. First look at the problem by separating the operating system (OS) kernel from the OS applications. If we look at vulnerabilities in this respect, "applications" have been under attack for decades. Perusing the CERT Advisories list (transitioned to the US-CERT's Technical Cyber Security Alerts in 2004), we see warnings about application vulnerabilities since 1988. For example, in December 1998 we have CA-1988-01: ftpd Vulnerability.

You might say that my separation of OS kernel and OS applications doesn't capture the spirit of SANS' "prediction." You might think that their new warning means we should focus on applications that don't ship with the "OS." In other words, look at widely deployed applications that aren't bundled with an OS installation CD. Using that criteria, "application attacks" are still old news. Check out this July 2001 advisory, CA-2001-16: Oracle 8i contains buffer overflow in TNS listener. That was followed a month later by CA-2001-24: Vulnerability in OpenView and NetView and three months later by CA-2001-29: Oracle9iAS Web Cache vulnerable to buffer overflow.

Maybe my background as a history major is at work here, but I think "hackers" have been attacking applications for years.

Comments

Anonymous said…
Hi Richard,

My comments are at http://www.emergentchaos.com/archives/000840.html

Does blogger support trackback yet? :)
2:37 PM
Anonymous said…
Like in the previous comment, I think you miss the point concerning SANS prediction about application level attacks. IMHO what SANS states here is that application level attacks will develop much more this year and be much more used. I think it's clear for everybody that this type of attacks has existed for years.
2:55 PM
Richard Bejtlich said…
Thanks as always for reading and commenting. However, just because the public is waking up to the realities of intrusions doesn't mean anything new is happening. Five years ago three citizens of Kazakhstan were arrested for allegedly breaking into Bloomberg L.P.’s ("Bloomberg") computer system in Manhattan in an attempt to extort money from Bloomberg. Four years ago SANS itself partnered with the FBI to warn of Eastern European organized crime that had "stolen credit card and other data from at least 40 domestic e-commerce and e-banking sites." Three years ago I performed an incident response involving $10 million in fraudulent product orders gained via application attacks. These sorts of attacks and their motivations "matured" years ago.
9:32 PM
Richard Bejtlich said…
I forgot to mention that the Romanian organized crime incident response I did in 2002 was the end of an intrusion that started in 1999 -- six years ago. The intruder took advantage of an application vulnerability and proceeded to cash in on his exploitation of the victim company.
10:40 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more