hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
HP Security Research | Cyber Risk Report 2015ConclusionResearchers and analysts in the HP Zero Day Initiative were busy coordinating the disclosureand remediation of over 400 high-severity vulnerabilities in 2014. This year marks the highestnumber of disclosures in a single year. 2013 brought quite a few Oracle Java sandbox bypassesto the program. In 2014, however, <strong>research</strong>ers shifted to browser vulnerabilities, focusing mostof their efforts on Microsoft Internet Explorer.Looking ahead, we will continue to seea focus on browsersand plugins.ZDI <strong>research</strong>ers tuned their browser fuzzers to discover dozens of UAF vulnerabilities. A useafter-freevulnerability can occur when memory is allocated to an object that is used after it isdeleted (or deallocated). Good programming practice dictates that any reference pointing to anobject should be modified when the memory is deallocated, to keep the pointer from continuingto make the area of memory where the object once resided available for use. (A pointer in thisabandoned condition is broadly called a “dangling pointer.”) If the pointer isn’t modified and triesto access that area of memory, the system can become unstable or corrupt. Attackers can usea dereferenced pointer in a variety of ways, including execution of malicious code.Examining 2014 submissions revealed a mix of “old” and “new” vendors at the top formost disclosures:1. Microsoft2. Hewlett-Packard3. Advantech4. SAP5. AppleIn 2013 there were a number of SCADA vulnerabilities, but 2014 marks the first year where aSCADA vendor is among the top vendors with vulnerabilities disclosed against its products.Advantech focuses on automation controllers, industrial control products, and single boardcomputers. SAP is on the list due to an audit ZDI analysts conducted against one of its products,which yielded a large number of findings.Looking ahead, we will continue to see a focus on browsers and plugins that support them. Theattack surface offered by the complex software is used heavily when targeting governmentsand high-profile organizations.23