Security

Gosh, these 'hacker' nerds are only getting more sophisticated

Trustwave report flags up the security flashpoints of 2017


Hackers have moved away from simple point-of-sale (POS) terminal attacks to more refined assaults on corporations' head offices.

An annual report from security firm Trustwave out today highlighted increased sophistication of web app hacking and social engineering tactics on the part of miscreants.

Half of the incidents investigated involved corporate and internal networks (up from 43 per cent in 2016) followed by e-commerce environments at 30 per cent. Incidents affecting POS systems decreased by more than a third to 20 per cent of the total. This is reflective of increased attack sophistication, honing in on larger service providers and franchise head offices and less on smaller high-volume targets in previous years.

In corporate network environments, phishing and social engineering at 55 per cent was the leading method of compromise followed by malicious insiders at 13 per cent and remote access at 9 per cent. "CEO fraud", a social engineering scam encouraging executives to authorise fraudulent money transactions, continues to increase, Trustwave added.

Targeted web attacks are becoming prevalent and much more sophisticated. Many breach incidents show signs of careful planning by cybercriminals probing for weak packages and tools to exploit. Cross-site scripting (XSS) was involved in 40 per cent of attack attempts, followed by SQL Injection (SQLi) at 24 per cent, Path Traversal at 7 per cent, Local File Inclusion (LFI) at 4 per cent, and Distributed Denial of Service (DDoS) at 3 per cent.

Last year also witnessed a marked increase, up 9.5 per cent, in compromises at businesses that deliver IT services including web-hosting providers, POS integrators and help-desk providers. A breach of just one provider opens the gates to a multitude of new targets. In 2016 service provider compromises did not even register in the statistics.

Although down from the previous year, payment card data at 40 per cent still reigns supreme in terms of data types targeted in a breach. Surprisingly, incidents targeting hard cash was on the rise at 11 per cent mostly due to fraudulent ATM transaction breaches enabled by compromise of account management systems at financial institutions.

North America still led in data breaches investigated by Trustwave at 43 per cent followed by the Asia Pacific region at 30 per cent, Europe, Middle East and Africa (EMEA) at 23 per cent and Latin America at 4 per cent. The retail sector suffered the most breach incidences at 16.7 per cent followed by the finance and insurance industry at 13.1 per cent and hospitality at 11.9 per cent.

Trustwave gathered and analysed real-world data from hundreds of breach investigations the company conducted in 2017 across 21 countries. This data was added to billions of security and compliance events logged each day across the global network of Trustwave operations centres, along with data from tens of millions of network vulnerability scans, thousands of web application security scans, tens of millions of web transactions, penetration tests and more.

All the web applications tested displayed at least one vulnerability with 11 as the median number detected per application. The majority (85.9 per cent) of web application vulnerabilities involved session management allowing an attacker to eavesdrop on a user session to seize sensitive information.

The number of vulnerabilities patched in five of the most common database products was 119, down from 170 in 2016. 53 percent of computers with SMBv1 enabled were vulnerable to MS17-010 "EternalBlue" exploits used to disseminate the WannaCry and NotPetya ransomware attacks.

The 2018 Trustwave Global Security Report is available here. ®

Send us news
8 Comments

Cisco fixes two critical make-me-root bugs on Identity Services Engine components

A 10.0 and a 9.8 – these aren’t patches to dwell on

Cl0p cybercrime gang's data exfiltration tool found vulnerable to RCE attacks

Experts say they don't expect the MOVEit menace to do much about it

Young Consulting finds even more folks affected in breach mess – now over 1 million

The insurance SaaS slinger may trade under a different name, but past continues to haunt it

Former US Army Sergeant pleads guilty after amateurish attempt at selling secrets to China

PLUS: 5.4M healthcare records leak; AI makes Spam harder to spot; Many nasty Linux vulns; and more

Veeam patches third critical RCE bug in Backup & Replication in space of a year

Version 13 can’t come soon enough

Sitecore CMS flaw let attackers brute-force 'b' for backdoor

Hardcoded passwords and path traversals keeping bug hunters in work

Dems demand audit of CVE program as Federal funding remains uncertain

PLUS: Discord invite links may not be safe; Miscreants find new way to hide malicious JavaScript; and more!

Glazed and confused: Hole lotta highly sensitive data nicked from Krispy Kreme

Experts note 'major red flags' in donut giant's security as 161,676 staff and families informed of attack details

Asana's cutting-edge AI feature ran into a little data leakage problem

New MCP server was shut down for nearly two weeks

Apple fixes zero-click exploit underpinning Paragon spyware attacks

Zero-day potentially tied to around 100 suspected infections in 2025 and a spyware scandal on the continent

US infrastructure could crumble under cyberattack, ex-NSA advisor warns

PLUS: Doxxers jailed; Botnets bounce back; CISA questioned over app-vetting program closure; And more

AT&T not sure if new customer data dump is déjà vu

Re-selling info from an earlier breach? Probably. But which one?