The Vulnerabilities of the Past Are the Vulnerabilities of the Future

Major software vulnerabilities are a fact of life, as
illustrated by the fact that Microsoft has patched between 55 and
110 vulnerabilities each month this year – with 7% to 17% of those
vulnerabilities being critical.

May had the fewest vulnerabilities, with a total of 55 and only
four considered critical. The problem is that the critical
vulnerabilities are things we have seen for many years, like remote
code execution and privilege escalation.

Microsoft isn’t the only big name regularly patching major
vulnerabilities: We see monthly security updates coming from Apple,
Adobe, Google, Cisco, and others.

Everything old is new again

With major vulnerabilities in so many applications, is there any
hope for a secure future? The answer is, of course, yes, but that
does not mean there won’t be challenges getting there.

The vulnerabilities being seen may not be new to those of us who
have been defending against attackers^[1] for years or even
decades, but the adversaries continually change their tactics.

It is not uncommon for them to use legitimate resources for
nefarious purposes, and it may not always be possible to plan for
this misuse when an application is being built.

It’s your privilege

With 80% of security breaches involving privileged accounts, a
major vulnerability we will increasingly see exploited is privilege
escalation. A common tactic of ransomware operators and other
threat actors is to achieve elevated privileges on a system to help
legitimize their actions and gain access to sensitive data.

If an info stealer has the same access as the current user, the
chances of exfiltrating sensitive data are significantly increased.
Meanwhile, admin access nearly guarantees access to juicy data.

In addition to keeping software updated, this is where Zero
Trust initiatives and data flow monitoring become critical. At a
minimum, Zero Trust means that the principle of least privilege
should be applied, and multi-factor authentication should be
required wherever it is available.

Essentially, this ensures that anyone who does not need access
to a system or file cannot access it – while those who do must
prove that they are whom they say they are. Monitoring the flow of
data can also help catch a breach early on, limiting the amount of
data stolen.

Remote control

Remote code execution (RCE) is not going away any time soon.
These attacks accounted for around 27% of the attacks in 2020, up from 7% the
prior year^[2]. If an attacker can find
a way to run arbitrary code on your system remotely, they have a
lot more control than they would from just getting a user to run a
piece of malware with predefined functions unwittingly.

If the attacker can run arbitrary code remotely, they gain the
ability to move around the system and possibly the network –
enabling them to change their goals and tactics based on what they
find.

Behavioral monitoring is one of the best ways to detect RCE on
your systems. If an application begins running commands and
spinning up processes that are not a part of its normal behaviors,
you can put a stop to an attack early on. The fact that RCE is so
common also mandates that you keep security patches up-to-date to
stop many of these attacks before they even start.

Who needs malware anyway?

Today, a favorite attack method is using legitimate processes
and trusted applications to accomplish nefarious goals. These
fileless, or living off the land, attacks can be difficult to
detect because the malware does not need to be installed.

One of the most common applications to be exploited this way is
PowerShell. This makes sense because PowerShell is a powerful
application used to script and run system commands.

This is another instance where monitoring the behaviors of
applications and processes can be vital in stopping an attack
quickly. Does PowerShell really need to disable security
features?

In most cases, probably not. Behaviors like this can be
monitored, even from trusted applications like PowerShell. Combine
this monitoring with advanced machine learning and AI, and you can
begin fingerprinting normal behaviors on your network, with
automated responses to unusual activity.

Go forth and repeat yourself

While the common types of attacks may not change much, any
changes to application or code have the potential to introduce new
vulnerabilities. This doesn’t mean we should give up and just let
the adversaries win – it means that now is the time to double down
on our efforts to thwart their attempts.

Implement a patch management strategy,^[3] monitor the network, use
behavioral detection, and avoid complacency. The fact that major
software providers are regularly patching major vulnerabilities is
actually a good thing because the attackers are not giving up, so
neither should we.