Attack Trends

by analyzing them, we can assess the incident's impact and the at-tackers' skills and intent. We can build an entire taxonomy of attacks by understanding these programs' technical capabilities and their connection to those who develop and use them. For the past decade, exploit tools have signaled the evolution of a community of adversaries comprising numerous inexperienced and unskilled " ankle biters " — commonly referred to as script kiddies—and a few experienced, technically savvy attackers. Exploit programs are telltale signs of attack-ers' sophistication: if studied meticulously , they can provide insight into current and future trends. Webster's dictionary defines the verb exploit as " to use or manipulate to one's advantage. " In the context of information security, we translate this to mean taking advantage of a vulnerable system in a way that subsequently affects the system's security. Recognizing that attackers use exploit code as a weapon, we must understand how exploits work and what they're used for. The simplest form of exploit program is known as the proof-of-concept (POC) exploit. Its only goal is to demonstrate without a doubt that a security flaw exists, often by causing the vulnerable program to malfunction in a noticeable manner, such as terminating prematurely or abnormally. To prove not only that a given software bug exists but also that attackers could exploit it for specific purposes, the writer of a POC exploit generally turns to what software vendors and security researchers refer to as " execution of arbitrary code on the vulnerable system " to demonstrate that an outsider can execute commands on affected systems. Exploit tools are artifacts that let attackers fulfill their intentions beyond simply demonstrating that a software flaw exists. From the exploit developer's viewpoint, an exploit must be able to use a given vulnerability to achieve a specific goal, while coping with the vulnerable system's operational characteristics , including network topology, running environment, and security countermeasures. Studying exploits furnished by researchers or found " in the wild " on compromised systems can provide valuable information about the technical skills, degree of experience , and intent of the attackers who developed or used them. Using this information, we can implement measures to detect and prevent attacks. (Note that those who use an exploit are not necessarily the designers or developers. This becomes evident when attackers' actions during a network security compromise are not on par with the experience and …