Web application vulnerabilities continue to increase, says nCircle

By Robert Westervelt | Jul 3, 2009

0 comments

Facebook

LinkedIn

Digg

Web application security scanners are finding increasing numbers of coding errors, according to the latest statistics from compliance auditing vendor, nCircle.

The latest study by nCircle found that Web application vulnerabilities from 2007 to 2008 increased by 154% and are continuing to grow by 25% so far this year. But the growth occurred even as the total number of overall security flaws is decreasing, said the security vendor.

SQL injection errors remain the biggest problem for Web applications, followed by cross-site scripting errors, input validation flaws and code injection errors.

nCircle said it detected more than 3,000 new Web application vulnerabilities in 2008. So far the vendor says it's on track to exceed that number this year. In the first two quarters of 2008, nCircle detected 1,548 Web application vulnerabilities.

The statistics could signal some good news for firms since more vulnerabilities are being detected before they are targeted by hackers. Still, Web application security expert Ryan Barnett said it can be challenging to create automatic scanner checks for many classes of vulnerabilities, such as cross-site request forgery and stored cross-site scripting. The rising vulnerability numbers could also reflect the fact that firms are developing Web applications in increased numbers. The awareness of Web application security issues is causing more organizations to assess their apps with vulnerability scanners, said Barnett, director of application security research at Breach Security Inc.

"Although all of the vulnerability scanning statistics list cross-site scripting as the No. 1 vulnerability in websites, the fact is that profit driven attackers are not yet leveraging them as they haven't figured out a way to directly monetize and automate them," Barnett said. "This may change in the near future, however, as more and more client driven attacks are being tested out on social network sites such as Facebook and Twitter."

Successful attacks on users of Facebook and Twitter demonstrate the ability of hackers to spread wormable code that can impact a large number of users, Barnett said.

0 comments

Facebook

LinkedIn

Digg