There has been a significant increase in the volume of organised cyber crimes targeting data centres and networks, HP has revealed, pointing to web exploit toolkits as the No 1 cyber crime weapon.
In its 2010 Top Cyber Security Risks Report, HP said that while there were more attacks recorded in 2010, the number of discovered vulnerabilities remained relatively stable, but high.
The new report indicates that while the majority of attacks are against known and patched security vulnerabilities, many high-profile attacks use new vulnerabilities before vendors issue fixes.
A key finding in the report by HP DVLabs is the dramatic increase of web exploit toolkits. These “packaged” attack frameworks are traded online, enabling attackers to access enterprise IT systems and steal sensitive data.
According to the report, web exploit toolkits are rapidly growing as the weapon of choice by attackers due to ease of use and high success rate.
Web app vulnerabilities
Web application vulnerabilities represent half of all security vulnerabilities and continue to plague enterprises.
The report identifies third-party plug-ins to content management systems as a leading cause of web application vulnerabilities.
Blog-hosting and online discussion forum applications, such as WordPress, Joomla and Drupal, are among the most frequently attacked systems.
“We’ve discovered that rather than investing resources to uncover new exploits, attackers are focused on current, unpatched vulnerabilities in web applications, social networking sites and Web 2.0 interfaces,” said Mike Dausin, manager, Advanced Security Intelligence, HP DVLabs.
“HP TippingPoint, ArcSight and Fortify security solutions, coupled with HP’s experience in IT management and application life cycle management, offer clients protection from the latest attacks threatening to disrupt business continuity.”
