Know your enemy is a good defence for any country, or enterprise.
So here’s more advice for CSOs from another security vendor about what they’re likely to face in the short term.
Microsoft Internet Explorer vulnerabilities have increased more than 100 per cent since 2013, according to Bromium Inc., a Cupertino, Calif., endpoint security company that studied vulnerabilites and exploits discovered in the first six months of the year.
The trend is underscored by a progressively shorter time to first patch for IE’s past two releases, the vendor added.
Almost all Internet Explorer memory corruption exploits now use de facto ROP (Return Oriented Programming) techniques for bypassing the default Operating System security mechanisms (ASLR, DEP), the company said.
Its full report can be read here.
In the first half of 2014, the growth in zero day exploitation continued unabated from 2013, it says. Unsurprisingly, all of the zero day attacks targeted end-user applications such as browsers and productivity applications like Microsoft Office. Typically these attacks are launched leveraging users as bait using classic spear-phishing tactics.
“The notable aspect for this year thus far in 2014 is that Internet Explorer was the most patched and also one of the most exploited products, surpassing Oracle Java, Adobe Flash and others in the fray. ”
Bromium Labs believes that the browser will likely continue to be the sweet spot for attackers.
It also found that public Java zero-days exploits declined after leading last year among vulnerabilities and public exploits. In fact, there were no reported Java zero-day exploits so far this year.
Meanwhile, so-called Action Script Sprays are driving zero-day attacks. Both Internet Explorer and Flash zero-day attacks have leveraged Action Script Sprays, an emerging technique that bypasses address space layout randomization (ASLR) with a return-oriented program (ROP) chain.
“End users remain a primary concern for information security professionals because they are the most targeted and most susceptible to attacks,” Rahul Kashyap, Bromium’s chief security architect, said in a release. “Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.”
