August 25, 2014 By Leslie Horacek 4 min read

Today, we released the third edition of the 2014 IBM X-Force Threat Intelligence Quarterly. One of its key features was a look back over the past four months as we analyzed data and trends in the wake of Heartbleed (CVE-2014-0160), one of the most widespread and impactful security vulnerabilities of all time.

From attack trends to vulnerability scoring, this report looks at how relevant this pervasive vulnerability is today and what we can learn about mitigation strategies for similar types of attacks in the future. Additionally, the report looks at overall vulnerability trends for this period and discusses some observations and theories regarding why disclosures may be lower than those made in previous years.

The Heartbleed Disclosure

So far, the disclosure of the Heartbleed vulnerability in the OpenSSL library has been the biggest event to hit the security industry in 2014. So much has been written about this bug, and yet its effects have been so widespread that it brings a number of discussion topics to the surface.

Much emphasis has been placed on preparing for and mitigating zero-day attacks, but in the case of Heartbleed, a more interesting study occurs after disclosure, when both attackers and enterprises are racing against the clock. Attackers want to capitalize on the vulnerability as much as possible before there is a widespread patch campaign, while the enterprise is racing to ensure there are protections in place.

IBM’s Managed Security Services (MSS) witnessed attackers immediately retooling and exploiting the bug on a global scale. Once the major vendors for intrusion detection and prevention systems created protection signatures, MSS was able to see just how bad the situation had become. On April 15, 2014, MSS witnessed the largest spike in activity across the customer base, with more than 300,000 attacks in a single, 24-hour period. That is an average of 3.47 attacks per second for hundreds of customers.

Attackers Waste No Time

One-day attack methods demonstrate how quickly attackers rush to exploit a vulnerability such as Heartbleed. Just one day after the disclosure, a proof-of-concept tool capable of exploiting the Heartbleed bug began to circulate, exposing unpatched systems to skilled and unskilled attackers alike. But more troubling is the fact that also a day after the disclosure, attacks leveraging the vulnerability began to occur.

For one-day attacks, the attacker’s goal is to take advantage of the exposure window between when the patches are announced and when the patches are usually deployed.

6 Strategies to Protect Against These Attacks

The following are six strategies you can use to mitigate these types of attacks:

  1. Keep up with threat intelligence. A timely source of information on the latest threats is critical for keeping organizations informed and allowing them to respond as quickly as possible.
  2. Maintain a current and accurate asset inventory. When a critical vulnerability is publicized, you don’t have time to try to figure out where your vulnerable, exposed assets are located. Attackers are engaged in the same pursuit, and effective defense should not be a race toward discovery. As a defender, this is one area where you should have the upper hand.
  3. Have a patching solution that covers your entire infrastructure. Apply patches as soon as vendors release them, and implement a rapid burn-in procedure, including back-out plans, to make sure patches don’t break operational systems.
  4. Implement mitigating controls. Firewalls, intrusion prevention systems and endpoint protection can all help protect against new threats during the period between the vulnerability disclosure and when you’re able to apply vendor patches.
  5. Instrument your environment with effective detection. Knowing when you’re being attacked is crucial to responding as early as possible, ultimately before attackers steal or corrupt data.
  6. Create and practice a broad incident response plan. All activities related to vulnerability disclosures and active attacks must be guided by processes involving all levels of your organization and guided by clear procedures for a variety of situations. Test the procedures often to make sure you aren’t working out the kinks when an actual emergency arises.

Disclosures on the Decline

In the first half of 2014, we reported just over 3,900 new security vulnerabilities affecting 926 unique vendors. If this trend continues through the end of the year, the total projected vulnerabilities would fall below 8,000 total vulnerabilities for the first time since 2011.

However, does the current CVSS represent actual risks to networks and systems? The report discusses why this decline in total vulnerabilities might be happening and touches on the subject of the current scoring system. Inherent flaws in the current CVSS(v2) standard and a clear lack of guidelines on how to objectively assess certain types of vulnerabilities often fail to reflect the true risk a vulnerability may pose to an organization. This causes an overall loss of confidence in the CVSS score as an accurate and reliable measure of risk. This report explores the most obvious (latest) example with the OpenSSL vulnerability (Heartbleed), which was rated a medium base score of 5.0.

Download the latest research from IBM X-Force

With the number of products and systems affected, the time and attention IT teams spent patching systems and responding to customer inquiries and the potential sensitivity of the exposed data, the true impact of Heartbleed was much greater than the CVSS base score would indicate.

More from X-Force

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

Getting “in tune” with an enterprise: Detecting Intune lateral movement

13 min read - Organizations continue to implement cloud-based services, a shift that has led to the wider adoption of hybrid identity environments that connect on-premises Active Directory with Microsoft Entra ID (formerly Azure AD). To manage devices in these hybrid identity environments, Microsoft Intune (Intune) has emerged as one of the most popular device management solutions. Since this trusted enterprise platform can easily be integrated with on-premises Active Directory devices and services, it is a prime target for attackers to abuse for conducting…

You just got vectored – Using Vectored Exception Handlers (VEH) for defense evasion and process injection

10 min read - Vectored Exception Handlers (VEH) have received a lot of attention from the offensive security industry in recent years, but VEH has been used in malware for well over a decade now. VEH provides developers with an easy way to catch exceptions and modify register contexts, so naturally, they’re a ripe target for malware developers. For all the attention they’ve received, nobody had publicized a way to manually add a Vectored Exception Handler without relying on the built-in Windows APIs which…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today