As investigators continue to probe the origin of the recent Sapphire (a.k.a. Slammer) worm, which wreaked havoc on parts of the Internet this past weekend, new reports have emerged suggesting that virus writers continue to identify new kinds of exploits. And studies from market researchers at Gartner as well as a study from Frisk Software, a security software firm, conclude that users and enterprises aren't paying enough attention to the simple steps they can take to protect themselves from attack.
Frisk Software analyzed the structure of many of the cyberattacks seen in 2002. According to the company's report, "Viruses that exploit bugs in programs such as browsers and mail clients to aid their distribution have become more common than before. The most frequently used exploit last year [was] probably the IFrame exploit. This is an exploit of a bug in the HTML-rendering engine of Internet Explorer, which allows the automatic execution of files attached to e-mail messages when these messages are opened." The Klez.H worm, which Frisk tracked as the most widespread worm or virus of 2002, uses the Iframe exploit. Frisk found the Klez.H worm in 66 percent of the infected messages the company tracked last year. The Lentin (a.k.a. Yaha) virus and the Bugbear worm were the second and third most prevalent viruses of those tracked by Frisk.
One big change in the dissemination of viruses in 2002, noted not only by Frisk but by most other security software firms, was the use of new social engineering techniques by virus writers. "Instead of relying on adult-oriented phrases or quotes to catch the user's attention, the virus writers seem to have turned towards other forms of social engineering, such as referring to trusted companies (for example, antivirus companies and other software companies like Microsoft) in the subject line," says the Frisk report.
What can users do to protect themselves from viruses and worms? The overwhelming problem continues to be failure to install simple patches and keep security software updated. According to Frisk's study, even software patches that have been in circulation for some time don't get applied by users: "A large portion of computer users ignore the security warnings from companies such as Microsoft, and continue to use unpatched programs, thus allowing the outbreaks of viruses, which would have otherwise easily been prevented." For more advice on protecting against viruses and worms, see PC Magazine's coverage of security software.
In another report, issued this week by market researchers at Gartner in response to the recent Sapphire attack, analyst John Pescatore noted that "software products that require frequent patches are the most popular targets for attackers." The Sapphire worm exploits a flaw in Microsoft's often-patched SQL Server software.
"Before exposing such products to the Internet," says Pescatore, "enterprises should perform vulnerability scanning at least weekly and institute a rigorous security-patch management program." The Sapphire worm brought portions of the Internet to its knees over the weekend, and virtually shut down Internet traffic in South Korea for some of the weekend.