Security holes add up in second quarter

More than 422 new Internet security holes were found during the second quarter, according to data released Monday by the SANS Institute.

This represents an increase of 10.8 percent compared with the number found in the first quarter, and a jump of 20 percent compared with the second quarter of last year, the institute said in its quarterly report.

If companies and individuals don't take corrective action, the agency warned, their systems could be used by remote hackers for identity theft, industrial espionage, and distribution of spam and pornography.

In order to be included on the quarterly list, the vulnerabilities must affect a large number of users, the SANS Institute said. Additionally, they must allow an attacker to take control of a PC remotely, and they must remain unpatched on a substantial number of systems. Information sufficient to let people exploit the flaws must be available on the Net.

Among the flaws are serious vulnerabilities in popular data backup products used by enterprises, while home users face increased risk from holes in iTunes and RealPlayer, as well as Internet Explorer.

"We are seeing a trend to exploit not only...Windows, but other vendor programs that are installed on potentially large number(s) of systems," said Rohit Dhamankar of TippingPoint, which collaborated with the SANS Institute for the study.

"These include backup software, management software, licensing software, etc. Flaws in these programs put critical resources at risk, as well as having a potential to compromise the entire enterprise."

Too many people with too much time on their hands. Some of these jerks do it for profit, others for grins. Nice to have a hobby.

Michael M. Bates: My Side of the Swamp

I suspect there's a bunch of software quality control people running around that:
- Have no imagination
- Have little knowledge about the internal workings of the Internet
- Are not involved nearly early enough in the software development process

I also suspect there are lots of software developers who look upon the qc folks with disdain.

2 posted on 07/25/2005 11:18:05 AM PDT by upchuck ("If our nation be destroyed, it would be from the judiciary." ~ Thomas Jefferson)

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.