Why a Crippling Attack Against US Companies is Very Possible

Sure, some people are doomsayers and we look at them as fringe folks with a grain of truth expanded out to being an entire movement. I'm not being a doomsayer, but a realist, when I say that a concerted web attack on US companies is very possible.

First, in America we believe we are invincible and the smartest, most savvy people on the earth. We are prideful and boastful and believe we deserve every good thing, whether we work for it or not. I know that is a generalization but look around at the people in your neighborhood...I may not be describing YOU but look around you. In the "You serve me" mentality, people think security is someone else's thing, and that others will protect them. In companies, I've seen it where dollars outweigh quality and bad software gets shipped. If they are cutting corners on functionality, do you think they are even doing security on the pieces they create?

Second, we all know security is not "baked in" yet. It is something people add on top of the functionality that makes them money, if they get time. And right now times are tough financially...do you think companies are going to invest in baking security into the software lifecycle? While cutting jobs or shipping them overseas? While cutting corners and costs?

But the bad guys aren't taking time off to let us retool. What happened to Google and Intel and other companies lately is going to continue. Our image of everyone else in the world being less intelligent than us leads us to both our lack of diligence and to their anger against us. Do IT folks (and comical TV ads) bash Microsoft for just the same reasons of them being the arrogant big guy? Like it or not, people are putting our machines under their silent control and putting things in our hands to use against our own companies, government agencies, etc. Some of these botnets are for spam but it is clear now that no one is immune to flat out attack. A little social engineering and mom & pop machine takeover and you have a virtual army set to strike.

Recent stats say that 3-10% of all corporate PCs are compromised right now with malware that most likely puts them into a botnet. These are the places with good protections in place.

This blog started because I was floored at how many developers in big named companies were building sites with big security flaws. I assumed the little guys weren't doing security the best but to see some big companies not doing it floors me. As "invincible" Americans we learn many lessons the hard way and it is not going to do us, and the country we love, any good to learn this lesson that way.

If you are not learning about web security today, and making sure your sites don't allow for attack on/by them, then you are giving some really bad, money-driven people a foothold, a soldier. Enough footholds and you have an army.

My thinking is that many of the devs won't read this post at all even if presented with it, and if they do read it they will poo-poo it as someone else's concern or some doomsayer's rant. It is the way we are as humans and Americans, and we run a strong risk of falling hard simply by not doing the grunt work today.

How Attacks Are Being Done Today

I was going to write my next post about XSS as it is such a prevalent attack that opens the door to other attacks, but I had to post about what I just read instead. I'll hit XSS soon.

An article in darkreading.com¹ was saying that Mandiant researched attacks over the last seven years and found that APT attacks (Advanced Persistent Threat), besides seeming to have Chinese ties (I won't go there as I don't think it matters where they come from, just that we stop them from any location, including our own companies), are so nasty that security software was able to detect only 24% of the malware used in the attacks!

So these attacks are going on right now undetected...

In addition, there are seven stages of APT attacks:

1. Reconnaissance - checkin' you out and getting a lay of the land
2. Intrusion into the network - finding the hole and getting in
   
3. Establishing a backdoor -- a piece of wood to hold the door open
4. Obtaining user credentials -- social networking and electronic means
5. Installing multiple utilities -- remember the door you left open in #2 and #3?
   
6. Privilege escalation, lateral movement, and data exfiltration -- taking over via open door
   
7. Maintaining persistence -- making sure you can't delete it

Ouch!

Two things I note here -- 1) you have seven opportunities to catch them and stop them and this isn't happening, 2) YOU as a developer can stop them at #2, thus stopping the whole thing. Don't you see it now? If developers did their job to their best ability, the holes would not exist as much as they do. Would holes be found? Sure. Can we plug everything? I don't think so. But these are prevalent attacks, over seven years! Devs, get over it and learn how to code securely!!

I can't tell you how many devs think they don't need to learn security coding because they simply do intranet programming. See #6 above...they are in and using those loose security intranet apps to take over your organization. How cozy do you feel behind your firewall now? Come on gang! Learn the easy stuff and stop them!

Yes, stopping these attacks is easy...I'll show you how to stop XSS next and you will be that much more protected. Stop making excuses and do what you have to do to protect your organization and your customers!


¹ http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=222600139