Web applications experience 27 attacks per hour on average — roughly one attack every two minutes — according to findings from a US-based data security provider.
Imperva’s latest Web Application Attack Report (WAAR), conducted December 2010 through May 2011, found cyber criminals are increasingly using automated attacks launched from captured ‘botnet’ computers. The study monitored and categorised more than 10 million individual attacks across the internet, as well as on 30 different enterprise and government Web applications. It established that attack traffic during the six-month period was characterised by high volume activity followed by longer periods of lighter activity — key indicators of automation.
When websites came under automated attack they received up to 25,000 attacks in one hour, or seven attacks every second. The findings could have far-reaching implications for CIOs and security personnel. “Most security research focuses on vulnerabilities and while this can be extremely valuable, it doesn’t always help businesses prioritise their security efforts,” said Imperva CTO and lead researcher, Amichai Shulman.
For example, the Open Web Application Security Project (OWASP), which lists the 10 most dangerous current Web application security flaws, does not identify remote file inclusion (RFI) and directory traversal as top vulnerabilities. However, WAAR shows that these are two of the most common attacks used by hackers to steal data.
“It is impossible to have effective risk management without understanding which vulnerabilities are most likely to be exploited,” Shulman said.
According to WAAR, the four most prevalent web application attacks are:
- Directory traversal — 37 per cent
- Cross site scripting — 36 per cent
- SQL injection — 23 per cent
- Remote file inclusion — 4 per cent.
Notably, these attacks are often used in combination to scan for vulnerabilities and subsequently exploit them.
“The level of automation in cyber attacks continues to shock us,” Shulman said. “The way hackers have leveraged automation is one of the most significant innovations in criminal history. You can’t automate car theft, or purse stealing, but you can automate data theft. Automation will be the driver that makes cyber crime exceed physical crime in terms of financial impact.
Alarmingly, advances in evasion are also significant.
“Our data shows that it is increasingly difficult to trace attacks to specific entities or organisations,” Shulman said. “This complicates any effort to retaliate, shut down cyber criminal gangs or identify potential acts of war.”