Slashdot Mirror

← Back to Stories (view on slashdot.org)

Number of Web Application Hacks Up

Posted by ryuzaki0 on from the i-haxxored-your-netflix-account dept.

An anonymous reader writes "According to an article at Information Week, 'Web site hacks are on the rise and pose a greater threat than the broad-based network attacks...' Citing statistics from the Web Hacking Incidents Database, 'Web hacking attacks numbered 58 in 2005, up from 16 in 2004 and 9 in 2003. Another 20 attacks have been reported this year against sites including open-source repository Sourceforge.net and social network MySpace.com, putting 2006 on pace to be the worst year yet.'"

6 of 53 comments (clear)

  1. Number of hacking attempts by mysqlrocks · · Score: 4, Insightful

    Web hacking attacks numbered 58 in 2005, up from 16 in 2004 and 9 in 2003, according to the Web Application Security Consortium.

    And what percentage of "web hacking attacks" are reported to the Web Application Security Consortium? I would venture to guess that a very small number are reported making these numbers statistically meaningless.

    --
    Bradley Holt
    1. Re:Number of hacking attempts by mysqlrocks · · Score: 3, Interesting

      Even if only a small percentage of all web attacks are reported, if that percentage stays stable then a rise in the number reported implies a rise in the total number of attacks.

      Let's assume for a second that 1% of all attacks are reported. That would mean that 16 out of 1600 were reported in 2004 and 58 out of 5800 were reported in 2005. Now, let's say that the percentage of reports increased by 1% point in 2005. So, 1% reported in 2004 and 2% reported in 2005. That would mean that 16 out of 1600 were reported in 2004 and 58 out of 2900 were reported in 2005. So, in this scenario what looked look a 362.5% increase in attacks is actually only a 181.25% increase in attacks. So, a small change in the reported percentage could make a huge difference in the apparent increase. These numbers are so ridiculously low to begin with, I wouldn't be surprised if less than 1% of web attacks are reported. I looked through the list and can think of some attacks I know of to some pretty big sites that weren't reported. Plus, some incidents are pretty generic and don't address a specific attack while others do address specific attacks. So, their definition of a "Web hacking attacks" seems to be quite fluid. Basically what I'm saying is that these numbers are absolutely meaningless.

      --
      Bradley Holt
  2. Don't give the "hackers" that much credit... by Ravatar · · Score: 5, Insightful

    I wouldn't say the focus should be on the fact that there are a higher amount of attacks, rather the focus should be on people writing web applications with security low on their priority list.

  3. Tuttle? by daveo0331 · · Score: 5, Funny

    Who's reporting all these attacks? The city manager of Tuttle, Oklahoma?

    --
    Remember the days when Republicans were the party of fiscal responsibility?
  4. You've got to be Kidding! by Bananas · · Score: 4, Insightful

    You call double-digit hacks a growing trend? Where do these folks live, under a rock? Don't tell me you've never heard of Attrition.org? Just how many HUNDREDS of sites were defaced in the past?

  5. AJAX hacks will be cracked by PietjeJantje · · Score: 3, Insightful

    The number of cracks will rise because of AJAX hacking.
    It's not only the interface and usability which takes a leap in complexity if you want to keep stuff working.
    First, you have data communication on the background, for everyone curious to see. Second, there's a leap in usage and development and thus potential for crackers. Last, the average AJAX developer is inexperienced.