Security experts rate the world's most dangerous exploits

Criminal hackers continue to penetrate many more company networks
than most administrators care to admit, according to two security
experts who offered a list of the most effective exploits used to gain
entry.
Topping the list is an attack dubbed super-flexible pivoting. It
abuses Linux machines connected to a network's DMZ, or demilitarized
zone, to bypass corporate firewalls and access sensitive resources on
an internal network. The technique has already been used to steal vast
amounts of data, including "millions of credit cards," said Ed Skoudis,
a senior security consultant for InGuardians, a security company that
frequently responds to major network breaches.
"If the bad guy can get control of one of your DMZ machines, he
doesn't need to make inbound connections there anymore," Skoudis said
during a panel at the RSA security conference. "Instead, he can make
outbound connections that effectively give him inbound access on your
internal network."
Another powerful exploit Skoudis is seeing frequently is the
evolution of an attack known as pass the hash, which is used to
penetrate Windows servers. Windows authentication works by checking a
user's cryptographic hash, rather than password. Attackers can steal
the hash by exploiting a simple unpatched browser or application
vulnerability and then injecting it into the memory of the Windows box.
Although pass the hash has been around for a decade, the attacks
have remained successful. That's in part thanks to a proliferation of
software that streamlines the exploit.
Skoudis was joined by Johannes Ullrich, the CTO of the SANS Internet
Storm Center. Together, they presented their list of the world's most
dangerous new attack techniques and ways organizations can protect
themselves against them.
"The real big problem here is user education," Ullrich told a
standing-room audience. "And user education is more than going to the
user and saying don't click on it. User education also means getting
your own house in order."
Too many organizations are still failing to patch applications such
as Adobe's Flash and Reader, he added. In other cases, they aren't
teaching employees how to avoid social-engineering attacks on social
networking sites and elsewhere.

Other dangerous exploits include:
Advances in wireless attacks, such as those that hack a client
machine and then use it to connect to an access point tied to a
corporate network. Interestingly, this is easier to do with Windows
Vista and Windows 7 than their predecessors, Skoudis said.
Attacks that take advantage of shortcomings in SSL, or secure
sockets layer. The most glaring are SSL's focus on failed connections
rather than those that are successful and the number of banks that
still use non-SSL login pages.
Attacks against unprotected VoIP, or voice over IP, systems. Since
the beginning of the year, there have been some 5,000 scans of port
5060 every day. That's about five times the rate as in all of 2008,
said Ullrich, who monitors internet activity using half a million
sensors across the globe. The take-away is that admins should assume they've already been hacked.
"I believe that a determined but not necessarily well-funded
attacker can pretty much break into any organization," Skoudis said.
"If you think it's less than 50 percent, I think you need to look a
little more carefully."