Analysis of 15 million cyber attacks
A new web application attack report by FireHost offers an impression of the current internet security climate and provides statistical analysis of 15 million cyber attacks blocked in the US and Europe during Q3 2012.
Amongst the cyber attacks registered in the report, four attack types are categorized in particular as representing the most serious threat: Cross-site Scripting (XSS), Directory Traversals, SQL Injections, and Cross-site Request Forgery (CSRF).
One of the most significant changes in attack traffic seen by FireHost between Q2 and Q3 2012 was a considerable rise in the number of cross-site attacks, in particular XSS and CSRF attacks rose to represent 64 percent of the group in the third quarter (a 28 percent increased penetration).
XSS is now the most common attack type in the Superfecta, with CSRF now in second. FireHost’s servers blocked more than one million XSS attacks during this period alone, a figure which rose 69 percent, from 603,016 separate attacks in Q2 to 1,018,817 in Q3. CSRF attacks reached second place on the Superfecta at 843,517.
Cross-site attacks are dependent upon the trust developed between site and user. XSS attacks involve a web application gathering malicious data from a user via a trusted site (often coming in the form of a hyperlink containing malicious content), whereas CSRF attacks exploit the trust that a site has for a particular user instead. These malicious security exploits can also be used to steal sensitive information such as user names, passwords and credit card details – without the site or user’s knowledge.
The severity of these attacks is dependent on the sensitivity of the data handled by the vulnerable site and this ranges from personal data found on social networking sites, to the financial and confidential details entered on ecommerce sites amongst others.
A great number of organizations have fallen victim to such attacks in recent years including attacks on PayPal, Hotmail and eBay, the latter falling victim to a single CSRF attack in 2008 which targeted 18 million users of its Korean website. Furthermore in September this year IT giants Microsoft and Google Chrome both ran extensive patches targeted at securing XSS flaws, highlighting the prevalence of this growing online threat.
“Cross-site attacks are a severe threat to business operations, especially if servers aren’t properly prepared,” said Chris Hinkley, CISSP – a Senior Security Engineer at FireHost. “It’s vital that any site dealing with confidential or private user data takes the necessary precautions to ensure applications remain protected. Locating and fixing any website vulnerabilities and flaws is a key step in ensuring your business and your customers, don’t fall victim to an attack of this nature. The consequences of which can be significant, in terms of both financial and reputational damage.”
As with Q2 2012, the majority of attacks FireHost blocked during the third calendar quarter of 2012 originated in the United States (11million / 74 percent). There has however, been a great shift in the number of attacks originating from Europe this quarter, as 17 percent of all malicious attack traffic seen by FireHost came from this region. Europe overtook Southern Asia (which was responsible for 6 percent), to become the second most likely origin of malicious traffic.
During the build up to the holiday season, ecommerce activity ramps up dramatically and cyber attacks that target website user’s confidential data are also likely to increase as a result. As well as cross-site attacks, the other Superfecta attack types, SQL Injection and Directory Transversal, still remain a significant threat despite a slight reduction in frequency this quarter.