« China Hijack, yet another CNN-jack, or simply a FOX-pas? | Main | eBook readers for education, redux »

Monday, 22 November 2010

Coping with "must have" top vulnerable applications

Bit9's annual list of top vulnerable applications for 2010 has few surprises.

If it's a browser, it's on the list. That's right: Firefox, IE, Opera, Chrome, and Safari account for nearly 1/2 of what Security News Weekly calls the Dirty Dozen.

Much of the rest of  list reads like an "our products" page at Adobe: Reader and Acrobat, Flash, and Shockwave are also among the applications with the highest number of critical vulnerabilities registered in the NIST vulnerability database from January through October 2010.

Microsoft Office, Apple QuickTime, Sun Java Dev Kit and Real Player round off the list of vulnerable applications that consumers and enterprises are likely to find on the majority of PCs and Macs in use today.

Bit9 recommends application reputation and location tracking, continuous endpoint monitoring and application whitelisting as means to mitigate the threats exploitable applications pose. These are terrific solutions for the enterprise, but don't help the average home or small business user who has to cope with similar threats.

If you are a home or small business user, consider these measures:

  1. Keep your applications patch current. My article on application software scanners explains how software like AppFresh or Secunia PSI can simplify this task.
  2. Use the best of the lot rather than the worst. All the popular browsers are on the list. In a list where Chrome tops the list with 76 critical vulnerabilities, followed by Safari (60), Firefox (51), and IE (32), Opera (6) might be worth a look.
  3. Use something else. Mac users, make Apple's Preview your default application for PDFs.  PC users, try free Foxit Reader, which offers user controlled security features. MS Office users, consider OpenOffice.Org (OOo), available for MacOS and Windows. OOo is free and it's compatibility with MS Office gets better every release. Search NIST's list of critical vulnerabilities: OOo returns far fewer reported critical vulnerabilities than MS Office.
  4. Decide if it's really indispensible. Flash and Shockwave are flashy. With the long list of vulnerabilities, they may deliver a different shock value than you expect. Only you can decide whether your web experience will be diminished if you do without them. Search the list of critical vulnerabilities as you make your decision.

All of these may not be viable or desirable options for every user. Most are free, and the learning curves are not onerous. At the very least, please follow (1): keep your applications patch current.

Posted at 10:22 AM in All matters security |

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

Verify your Comment

Previewing your Comment

Posted by:  | 

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been saved. Comments are moderated and will not appear until approved by the author. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...

Post a comment

Comments are moderated, and will not appear until the author has approved them.

Your Information

(Name is required. Email address will not be displayed with the comment.)

Find me on Mastodon and Facebook

Spotlight Posts

  • Interisle's Phishing Landscape 2024 is here
    Our Interisle team today announced the publication of an industry report, Phishing Landscape 2024, A Study of the Scope and Distribution of Phishing. Interisle’s fourth annual study examines nearly four million phishing reports collected from May 2023 to April 2024 and provides historical measurements using over 15 million phishing reports collected at the Cybercrime Information Center over a four year period. Findings from the study: • The total number of phishing attacks grew to ~1.9 million incidents worldwide. • Phishing attacks hosted at subdomain providers increased by 450,000+ reported names, representing 24% of all phishing attacks. • The use of...
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Spotlight: Impersonation phishing using exact match hostnames
    Phishers have long embedded exact matches of brands in domain names that they register for phishing. Company, service, or product names in domains continue to deceive less technically savvy members of society. Phishers are increasingly using exact match strings to compose hostnames at free web sites for phishing. My Interisle colleagues and I looked at the web site domains and subdomains used in phishing attacks from November 2023 through January 2024. During that period, impersonation attacks against two brands stood out: United States Postal Service (USPS) and Facebook. Looking closely at these two brands, we are able to illustrate how...
  • Cybercrime supply chain interviews with Spamhaus Team
    The Spamhaus team recently interviewed me to learn more about Interisle's recent study, Cybercrime Supply Chain 2023, where we examine the supply chains used by cybercriminals to acquire resources for malware, spam, and phishing attacks. In Trends, policy and cheap TLDs - an interview with Dave Piscitello (Part 1), we dive into some of the study's key findings: Nearly 5 million domain names identified as resources for cybercrime. Over 1 million new gTLD domain names reported for spam activity. Over 500,000 subdomain hostnames reported as cybercrime resources at 229 subdomain resellers. The United States, China, India, Australia, and Hong Kong...

Search

My Photo

Categories