Slashdot Mirror
Serious Web Vulnerabilities Dropped In 2011
wiredmikey writes "It's refreshing to see a security report from a security vendor that isn't all doom-and-gloom and loaded with FUD. Web Application Security firm WhiteHat Security released a report this week (PDF) showing that the number of major vulnerabilities has fallen dramatically. Based on the raw data gathered from scans of over 7,000 sites, there were only 79 substantial vulnerabilities discovered on average in 2011. To compare, there were 230 vulnerabilities on average discovered in 2010, 480 in 2009, 795 in 2008, and 1,111 in 2007. As for the types of flaws discovered, Cross-Site Scripting (XSS) remained the number one problem, followed by Information Leakage, Content Spoofing, Insufficient Authorization, and Cross-Site Request Forgery (CSRF) flaws. SQL Injection, an oft-mentioned attack vector online – was eighth on the top ten."
The one time I have a chance at first post, and I have nothing interesting to say. :(
Always assume it's not safe enough or at least acknowledge that's the amount of security you're willing to pay for. Am I wrong?
Perhaps security firms are the kind of firms that are *supposed* to give you bad news.
The Secretary of Defense doesn't walk into the Oval Office and says: "It seems it's all well and good for now, you can go play with Bo for the rest of the day, Mr. President."
"It's refreshing to see a security report from a security vendor that isn't all doom-and-gloom and loaded with FUD."
They're doing it wrong. Don't assume that if you can't see it, it isn't there.
#fuckbeta #iamslashdot #dicemustdie
Give me address there.
there were only 79 substantial vulnerabilities discovered on average in 2011.
It's one data point, isn't it? What exactly are they averaging here?
#DeleteChrome
See? You get what you pay for.
Most of those vulnerabilities are due to implementation and lack of good QA, not your hosting/ops/protocols fault.
Vulnerability statistics for all CVE data are available here : http://www.cvedetails.com/vulnerabilities-by-types.php
Statistics for all CVE data are also similar to White Hat report.
Unfortunately, 'Mark Zuckerberg', 'The Nation State', and 'Google' remain on the list of outstanding serious web vulnerabilities, leading some to wonder whether it would be necessary to introduce a system weighting the seriousness of vulnerabilities as well as merely enumerating them...
OMG, what next? A calf with two heads? We're doomed!.
Oh, the beautiful gloss of greality!
Time are tough at Adobe, you know. They can't afford to devote as many programmers to putting in as many vulnerabilities into Flash as they used to.
The most serious web vulnerability sits in the chair.
--
BMO
Websites are so god awful and packed with 10 dozen scripts, flash, embedded garbage now they are their own viruses.
As I see no technical reason for web-applications to be less vulnerable, my guess is that black-hats that find vulnerabilities are just more careful with them in order to be able to exploit them longer.
The other reason I see is that the metric is wrong. It may just be that the vulnerability-types have changed and the metric used but this report has not kept up.
Anyways, no reason to celebrate. Practical IT security is still in a very sad state and I do not see this changing anytime soon. By now I believe that the currently active developer generations have to retire and be replaced by ones with security-awareness. As this "new" generation is still not being educated, the problem will be with us at least for several decades.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It seems the crackers are now using dirty sites and SEO to attack ignorant users to them instead of targettng legit sites and injecting them with malware for drive byes like before.
Anyone else notice when searching for something techical in Google you will see comments which are identical in like 5 sites where 4 are just copied from the 5th? Some do not even have domain names as AV software can detect and block these. The comments are copied to make the site hit SEO numbers and have tons of ads that play videos wether you click on them or not so they can steal some money and some even inject malware.
It is frustrating as I have to click around 2 or 3 sites to get the legitimate article I am looking for or comments that deal with an article I want to read etc.
Just a difference in tactics.
http://saveie6.com/
A calf with two heads? Do you have any idea how awesome that brand of head cheese would be? They could probably charge double per lb.
This issue is a bit more complicated than you think.
Seems like this last year or so there have been a far larger number of companies reporting their data being compromised than in past years.
In any case, I'd say between lulsec and anonymous, the hunt and the arrests of these asshats might just be causing them to lay low for a while.
I think the vulnerabilities are dropping because the three most commonly-used browsers, Internet Explorer, Chrome and Firefox, are all being patched and/or upgraded on a fairly frequent basis for a couple of years. Besides Microsoft's once-a-month (sometimes more) patches for IE, Chrome and Firefox are now on much faster update/patch cycles, and I think that has cut down on the number of issues with browser-based malware attacks.