Popularity is the biggest hack magnet

With few exceptions, widely used software gets hacked more often than unpopular software, regardless of app security

Page 2 of 2

The Internet and extended public beta test periods changed that problem, as most new major products have malware written for them before they are released now. It took hackers only two months to hack the email accounts of iPad owners and to find dozens of bugs.

Another more relevant example: Although QuickTime and Windows Media Player are more popular and suffer almost no attacks, RealNetwork's RealPlayer, which has been waning in popularity, is still implicated in 3.3 percent of Web attacks, according to Microsoft's Security Intelligence Report 8. My guess is those attacks must be coming from the millions of old and unpatched machines still running RealPlayer. However, it's a deviation, unless RealPlayer is actively used on more desktops than the other two -- but I can't believe that.

Another small exception is Microsoft Kerberos, which runs on every domain-joined Windows 2000 and later Microsoft platform by default. Although MIT invented Kerberos, its use in the Linux and Unix world is close to nonexistent. Yes, Microsoft Kerberos has far fewer vulnerabilities and hasn't really been attacked, whereas MIT Kerberos has, in a few minor incidents. Because neither version is successfully attacked in the wild in relevant numbers, I tend to regard the finding as incidental.

When a particular category isn't attacked much on the whole, it's hard to take a few incidents to make a categorization. Mobile phones are an example of this exception. Although cell phones have increased in popularity significantly over the past few years, the number of successful attacks against them hasn't risen in accordance. Yes, we hear about iPhone attacks, but they're rare enough to be almost anecdotal. I get wind of malware on other mobile phone platforms (Symbian, Nokia, and so on), but none of them occur with any real frequency, even though every security pundit (including myself) predicts the coming of the cell phone virus, year after year.

But as a general rule, and with few exceptions, the corollary holds. Why does it matter? Well, past behavior is the best indicator for future behavior. The corollary teaches us that hackers and malware will always successfully exploit whatever is popular in a given timeframe. When a vendor says it will create the most secure software ever, that may be true: The vendor's product may contain fewer bugs and be more secure. But it doesn't mean that the bad guys won't p0wn the software as readily as they did last year. In fact, it appears quite likely that the hackers will keep on trying --- and succeeding -- because that's where the money is.

This story, "Popularity is the biggest hack magnet," was originally published at InfoWorld.com. Follow the latest developments in security and read more of Roger Grimes's Security Adviser blog at InfoWorld.com.

| 1 2 Page 2
From CIO: 8 Free Online Courses to Grow Your Tech Skills
View Comments
Join the discussion
Be the first to comment on this article. Our Commenting Policies