Vulnerabilities inside and out

I've often said in my columns how client-side attacks should be most administrators' No. 1 exploit worry. It's less and less common for attackers to break in through the front door. If I want to steal from a company over the Internet, it's much harder (these days) to find an exploit on the company's Web site or back-end database server. This is not to say that these types of attacks don't happen; they do, as any day's headlines will reveal. But it's not the most common way my clients are reporting. It's more likely that an end-user accidentally launched a worm or a bot that led to the compromise.

Spam a hundred malicious e-mails to an entity's employees and you're almost guaranteed to get a client-side execution. All the end-user education in the world still doesn't work if the spam e-mail looks authentic enough (that is, spear phishing). The end-user executes the client-side code or inputs their network credentials into a phish Web site, and the remote hacker has a backdoor tunnel that bypasses firewalls, IPSs, and all other security controls. Maybe you think you're safe because your end-users aren't logged on as admin or root. No worry: Standard end-users usually have more than enough access to let the hacker get what they want.

[ RogerGrimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

Why rob a bank with a gun when you're only going to get a few thousand dollars at most, along with an exploding dye pack and a guaranteed 5-to-25 years in prison? Instead, buy a spamming bot for a few hundred dollars, spend a few hours customizing your attack, and steal tens of thousands to millions. Your risk of getting caught is almost nil. And if you're one of the very few, unfortunate criminals that actually does get caught, you'll be hard-pressed to spend any time in jail. Usually the fines are less than what the criminal made in one day's haul. 

If you're working on your company's computer security strategy, pay at least as much attention to your client-side protections as you do preventing malicious hackers coming through the front door.

In order to back up this assertion, I decided to do some research (I apologize ahead of time as I concentrated on only Microsoft Windows exploits). I wanted to find out how many exploits were client-side attacks that required end-user interaction versus remotely exploitable attacks requiring no end-user interaction. 

Attack-type research

An example of the latter is when a remote hacker or worm runs a buffer overflow against a default installed, advertising service and gets complete control of the machine. MS-Blaster and Code Red are examples of this type of attack. Client-side, interactive exploits, on the one hand, require the user to click on or do something. Alternately, remote, non-interactive exploits are normally more dangerous than client-side attacks. An attacker can launch a single such attack, and it will break into millions of unpatched computers in a day. Client-side exploits, because they require end-user interaction, just don't spread as fast (although there are exceptions, such as the Melissa virus and Iloveyou worm).