Malicious Cyber Intrusion

As developers strive to meet the demands of the modern software development life cycle (SDLC), they are often confronted with the need to compromise security for faster release cycles. Without proper security, applications are prone to vulnerabilities, making them a target for attacks known as malicious cyber intrusions. Advanced hackers know this and are constantly on the hunt for a chance to execute a malicious cyber intrusion. These intrusions take place anytime a bad actor gains access to an application with the intent of causing harm to or stealing data from the network or user. In both cases, individuals and organizations are left with the risk of sensitive data exposure, known to result in costs in the millions. 

Open-source software, along with the growing number of application programming interfaces (APIs), has increased the amount of attack space, giving way to a broader attack surface. A larger surface means more opportunities for intruders to identify application vulnerabilities and instigate attacks on them— inserting malicious code that exploits those vulnerabilities. In the last five years, open-source breaches alone have spiked, increasing as much as 71%, leaving cybersecurity teams with a lot of work left to be done. To effectively develop a strategy of defense against malicious intrusions, security teams must first understand how these intrusions occur, then analyze how application vulnerabilities increase the probability of their occurrence.  

How a malicious intrusion occurs

For a malicious cyber intrusion to occur, a third party must gain access to unauthorized areas that house confidential information, core code, and application infrastructures. Intruders who launch a successful malicious intrusion often employ sophisticated techniques, using Malware-as-a-Service (Maas), artificial intelligence (AI), machine learning (ML), and more—though they start with a search for application weaknesses. 

Adding up attack probes versus exploits

The volume and velocity of cyberattacks on applications remain exponentially high. Over the past 12 months, individual applications experienced an average of 13,279 attacks each month. Yet, only approximately 2% of those actually reach a vulnerability that can be exploited. The remaining 98% were simply probes.

Searching for vulnerabilities

Before gaining access to core framework components, hackers analyze an application for vulnerabilities from the outside. One strategy employed by cyberattackers is to target open-source frameworks and libraries. An additional method uses vulnerability scanning tools, which identify vulnerabilities in an application. If a vulnerability is detected, cyberattackers can target it to gain access to exploit the application directly or use it to access other applications or data stores.

Exploiting an application breach

Once a vulnerability is identified, cyber criminals can commence an attack. The exploitation possibilities are immense. Relevant to the method of exploitation and area of entry, attackers can make changes that affect the application's entire system. Attackers can also instigate a ransomware attack or pilfer business-critical information and personally identifiable information (PII) for employees, contractors, partners, and customers. Once a cyber criminal successfully exploits an application vulnerability, they often can roam within the application and even gain access to other applications and data stores. In the case of the exploited application, they can alter or disrupt commands.                                 

What is malicious code?

Malicious code is anything that is part of a software system meant to cause harm or damage. Hackers use malicious code to break into vulnerable areas of an application system or network, which enables them to propagate, move laterally, and even take down security defenses. Malicious code poses a serious threat to applications. The latest Data Breach Investigations Report from Verizon reveals that data breaches tied to application vulnerabilities more than doubled over the past year to 43% of all data breaches.

Cyber criminals are increasingly turning to artificial intelligence (AI) and machine learning (ML) as part of their attack approach. In particular, ML algorithms are becoming more complex and accurate and can be used by bad actors to mine for vulnerability targets in applications and to determine what attack technique is best. An AI-enabled botnet, for example, can infect many more computers with malicious code and take control of them more effectively than humans can, resulting in faster and more unpredictable attacks.

Different types of malicious cyber intrusions

A whole new breed of cyber criminal is launching sophisticated, malicious cyber intrusions that legacy application security tools cannot match. Even brute force attack methods have evolved, as hackers look at HTTP responses after each and every attempt instead of merely taking a wild guess at credentials used to retrieve access. A malicious cyber intrusion at the application layer compromises a wide range of data, including that of the users and the database. Attacks to the application layer are becoming much more advanced, with the most common including:   

Cross-site scripting (XSS) attacks

Cross-site scripting (XSS) is a type of injection in which malicious scripts are injected into benign and trusted websites. XSS attacks occur when an attacker uses an application to send malicious code, typically in the form of a browser side script, to a different end-user. The browser of the unsuspecting user receives the malicious script and will execute due to its inability to identify whether or not the script should or should not be trusted. Malicious code intrusion can access several areas with sensitive information, including cookies and session tokens. It can even rewrite content on the HTML page. 

SQL injection attack

SQL injection attacks are on the rise: growing 41% in just the past few months. In this type of application attack, hackers insert SQL statements that cause manipulated executions to occur. Back-end data is retrieved, which puts entire web servers in jeopardy. Typical tenuous content hosted within a web server includes confidential identity details.   

Session hijacking attacks

A session is defined as the time in which two systems are in communication with each other. When session hijacking occurs, a cyber criminal can acquire cookies. This enables them to retrieve session IDs while remaining invisible to both users and servers. Different from hijacking, instead of waiting to retrieve user IDs during a session, a session fixation attack fixes a session into the target’s browser before logging in. With this information, both hijacking variations provide attackers access to all accounts used within the hijacked session, even those that use single sign-on (SSO) systems that house the credentials of numerous users.

Man-in-the-Middle attacks

When an attacker quietly rests somewhere between the user and the application, it is known as a man-in-the-middle (MITM) attack. Though it sounds uneventful, the time resting actually consists of thorough observation of all activity within a session, during which attackers can intercept data. This includes, and is not limited to, user IDs or even the entire cookies folder. MITM attacks on the application layer rely on vulnerabilities such as secure sockets layer (SSL)/transport layer security (TLS) configuration. This impersonation, or spoof attack, style is easily left undetected, leaving virtually no tracks until it is possibly too late.  

Distributed Denial-of-Service (DDoS) attacks

Overwhelming a system is known as a distributed denial-of-service attack (DDoS). Attackers can set impending attacks in motion by creating malicious bots that flood applications with traffic. The goal is to use this traffic to eventually overwhelm the application to the point that it becomes inoperable. If the website or application crashes, users are unable to access information or complete tasks. Unable to access the website or application, users lose confidence, their productivity decreases, and brand degradation sits in.

Regular expression Denial-of-Service (ReDoS) attacks

Another denial-of-service (DoS) attack is a regular expression denial-of-service (ReDoS) attack. Regular expressions (regex) are characters used to define search patterns. One vulnerability of regular expressions is their algorithmic methods of identification. Attackers exploit this weakness, creating expressions that are difficult to process, resulting in a slow running or unresponsive system.

Password attacks

To gain access to user accounts without the need for malware, attackers can launch a password attack. Like a brute force, some methods leave attackers to guess at passwords, attempting to break in by taking guesses time and time again. Others use help from a dictionary file, usually made up of common or previously used passwords that could result in a successful login.

Legacy application security approaches are not built to prevent malicious cyber intrusions

Application vulnerabilities are a top cause of successful malicious cyber intrusions. As noted above, Verizon found that data breaches resulting from application vulnerabilities jumped to 43% of all data breaches over the past year. While a vulnerability scan is a great starting point to sniffing out weaknesses, it comes with challenges. To begin, it generates large volumes of false positives, which distract application security teams from focusing on vulnerabilities that pose true risk. Second, scanning results are presented to application security teams in the form of PDF files that must be analyzed by specialized experts. This tallies into the hundreds or even thousands of hours for application security teams annually. Third, as scanning tools are based on signatures, they struggle to detect unknown threats. The result is missed vulnerabilities or (false negatives), which can cause irrefutable damages if left unremediated. And as time to remediate matters, with cyber criminals requiring only “seven days to weaponize versus 102 days to patch,” the risk is substantial.  

Penetration testing is just as, if not more, problematic when it comes to keeping pace with today’s advanced threat landscape. Designed for application development waterfall approaches with releases coming every few months at the most, penetration testing quickly accumulates technology debt in development environments that use Agile and DevOps approaches—with release cycles coming in days or even hours. And as penetration testing does not address vulnerabilities during development but typically shortly before release cycles, it costs dramatically more to fix a vulnerability. Further, as with vulnerability scanning, penetration testing requires specialized application security experts to run and analyze the tests. 

One final note is needed on vulnerability scanning and penetration testing: Both provide a point-in-time view and are not continuous. This also creates inaccuracies, such as false positives, that require significant time for triage and diagnosis.

Legacy perimeter defense solutions fail to stop malicious cyber intrusions

Web application firewalls (WAFs) have been in existence for more than two decades. Their outside-in approach to security relies on signature-based engines that must guess at whether attacks pose any risk. And with applications receiving an average of 13,279 attacks each month, this accounts for a lot of guessing. This results in a large number of false positives as well as false negatives. The former consumes valuable time on the part of the security operations (SecOps) team to triage and diagnose, while the latter can pose serious risk.

Once a malicious cyber intrusion is successful, it can wreak havoc in numerous ways (see above). Missed vulnerabilities, as a result, are not an option.

Using instrumentation for continuous, accurate production runtime

Organizations seeking to harness the advantages of the modern SDLC are turning to security instrumentation as an alternative to legacy application security approaches. Embedding security within software enables developers to automate the detection of vulnerabilities as they write code. It also provides context-aware vulnerability tracing and automates verification of vulnerability fixes. No application security experts or specializations are required. And because its security assessment is continuous, the risks that come with legacy application security tools are eliminated.

The same security instrumentation used to secure software in development can be extended into production to prevent attacks from exploiting vulnerabilities. Runtime application self-protection (RASP) sits alongside vulnerabilities in software and blocks attacks from exploiting vulnerabilities before they succeed.

RASP is also effective in that it only blocks attacks on vulnerabilities that can be exercised, unlike a WAF that guesses at what may pose a risk. This saves SecOps team significant cycles, enabling them to focus on other cybersecurity risks.

Advanced security tactics for advanced application development

As developers move toward more complex application developments that leverage Agile and DevOps, application security must remain up to the challenge. Further, malicious cyber intrusions pose a greater risk today than ever—and the application attack surface is broader than ever before. This offers cyber criminals a greater opportunity to exploit vulnerabilities with malicious cyberattacks.