Zero-Day Attacks Top Security Threat List

For the big picture on IT security, consider what the influential SANS Institute calls the two most important trends this year: a dramatic surge in zero-day attacks and multiple exploits of Microsoft Office. Oh, and keep an eye on voice-over-IP attacks.

The SANS Institute last week released its annual top 20 threats list (available at www.sans.org/top20). The increase in zero-day attacks--software bugs for which there are no patches--is the result of a fundamental change toward smaller, more targeted attacks. Criminals value zero-day attacks because they want to slip Trojan horse code undetected onto computers for a specific purpose, rather than send mass-havoc worms, says Roger Cumming, director of the United Kingdom's National Infrastructure Security Coordination Center.

A related trend is the big jump in attacks exploiting vulnerabilities in Microsoft's Office suite. Those attacks, which began in May with a zero-day assault against Word, continued through the summer, with Microsoft repeatedly patching the apps. Qualys, a security researcher and SANS list collaborator, says Office vulnerabilities tripled, and about 20% were zero-day vulnerabilities.

VoIP, meanwhile, is a risk to watch. Researchers worry about it being used to attack the conventional phone network. "The traditional phone network has never been accessible to hackers directly," says Rohit Dhamankar, senior manager of security research at 3Com's TippingPoint, "but if you can compromise a [VoIP] server, there's a chance you can craft special messages to the traditional network, perhaps crash the network."