Editors Note: I’ve been writing a lot about application and web security quite a bit lately, and that’s on purpose. There’s never been more attacks on our personal and private information. \u00a0These attacks are comging from not only lone hackers but also from state-supported groups and intelligence agencies. This guest post gives a good overview of what’s been going on and a little on the tactics we can take to combat these activities. This isn’t an exhaustive treatise on how to secure your applications. It’s more an intro course on the topic. It’s a springboard for you to dive into this vast and quickly-evolving world.<\/p>\n
How secure are your applications? While you might be confident about apps designed in-house, what about third-party software for desktops or mobile apps made using open-source code? Are current application security methods doing enough to meet the threat of cutting-edge cybercriminals, or are companies facing critical failure?<\/p>\n
At the beginning of March, information-sharing site WikiLeaks published what could be the largest release of CIA documents on record<\/a>, if the 7818 pages and 943 attachments actually belong to the spy agency.<\/p>\n Non-denial denials aside, however \u2014 according to spokesman Don Boyd, \u201cWe do not comment on the authenticity or content of purported intelligence documents.\u201d The released data contains a number of application attacks that could presumably net access to almost any device around the world. For example, some files contained instructions for compromising computer applications such as Skype, commercial antivirus programs and even PDF files. Applications such as \u201cWrecking Crew,\u201d meanwhile, could crash targeted computers while others claim the ability to breach both Apple and Android smartphones, in turn bypassing the encryption offered by tools like WhatsApp, Signal or Telegram. It doesn\u2019t stop there, though. A program code-named \u201cWeeping Angel\u201d \u2014 which the documents claim was developed in partnership with British intelligence \u2014 supposedly used Samsung smart televisions to listen in on conversations even when the device appears to be turned off.<\/p>\n There\u2019s also another level of concern here: An authentic leak means that even CIA servers and storage solutions aren\u2019t of reach for interested hackers. If the vaunted spy agency is at risk, what\u2019s the downstream consequence for the average application or device?<\/p>\n While the WikiLeaks story may be top of mind given its high-profile target and potentially dangerous app attacks, it\u2019s not exactly an outlier: Applications across multiple industries and government agencies are now under threat.<\/p>\n Consider the rise of connected-vehicle applications. Recent research suggests that Android-based connected car apps could be easily hacked<\/a> if attackers gain access to rooted phones or convince users to download malicious files. Once in control of the car app, cybercriminals could leverage the tool to gain physical access without setting off the alarm. Seven of nine car apps tested were vulnerable. Research firm Kaspersky noted that the problem didn\u2019t stem from code flaws but a simple lack of defense. According to security researcher Victor Chebyshev, these apps are \u201ccontrolling very valuable things for the user, but they\u2019re not thinking about security mechanisms.\u201d<\/p>\n North of the border, meanwhile, the Canada Revenue Agency (CRA) was forced to temporarily shutter its online services<\/a> and mobile applications after a vulnerability was discovered in Apache Struts 2, an open-source software tool that is widely used by government and private sector agencies alike. While there\u2019s no evidence of lost or stolen data, it\u2019s a sobering reminder that even popular (and presumably well-tested) applications can put companies at risk.<\/p>\nEmerging Threats<\/h3>\n
The Speed of Security<\/h3>\n