A new hacker project that promises to disclose one operating system kernel vulnerability daily hasn't yet come up with any serious bugs, a security company said Tuesday, but Gartner warned enterprises that the plan constitutes a security wake-up call.
Last week, security researcher HD Moore, co-creator of the Metasploit Framework penetration testing tool, began posting one kernel bug each day. In July, Moore ran a similar crusade, dubbed "Month of Browser Bugs" that released more than a score of new browser vulnerabilities, including some for Internet Explorer that were later patched by Microsoft.
According to Symantec, Moore's "Month of Kernel Bugs" has not yet put forward any major flaws. "Cursory analysis of these issues leads [us] to believe that the immediate threat posed by the issues disclosed so far is not high," Symantec wrote in an alert to customers of its DeepSight threat network.
So far, Moore and others have posted six vulnerabilities. One affects Apple Computer Inc.'s Mac OS X, one involves Microsoft Corp.'s Windows, one impacts the open-source FreeBDS operating system, one affects Sun Microsystems Inc.'s Solaris 10, and two are in the Linux 2.6 kernel.
Although Symantec took a wait-and-see position, research firm Gartner said that the danger level was higher.
"[This] is a serious wake-up call about the vulnerability of the most fundamental element of the operating system," said analyst Rich Mogull in a research note posted online. "Begin preparing now for more, and more damaging, attacks against the OS kernel."
The kernel, which is the core of the operating system where the most trusted code runs, may be technically challenging to attack, but once successful, a breach effectively hijacks the computer. Worse, the ongoing development of easy-to-use kernel exploit tools, notably Metasploit's work to add such attacks to its software, means users should expect more kernel-level attacks in the future.
"The incorporation of kernel exploits is a very early indication that the complex exploitation of kernel flaws will be simplified," added Mogull.
|
Symantec's Code Red: The Law Enforcement/Anonymous E-Mail Exchange Law enforcement officials negotiated via e-mail for more than two weeks with an Anonymous group member trying to extort $50,000 from Symantec to keep stolen product code off the Internet. |
|
How To Sell IT Security Services To Your Customers Cyberattacks can cost a business thousands, even millions, of dollars, and can deal a death blow to some. Here's how IT solution providers can help guard against malicious attacks. |
|
Cybersecurity Experts: What They Know Could Scare You A recent report based on interviews with security experts in government, business and academia finds more than half in agreement that a worldwide arms race is taking place in cyberspace. |
 More
Slide Shows |
- Insider Threats: The Next Frontier for Security Resellers and SMBs
- Complete Security and Your Bottom Line: Sophos, Value and the Channel
- Tough Threats, Tougher Security: How You Can Leverage New Solutions To Combat A “Targeted Attack” Landscape
- Dark Clouds Ahead: Why the Mid-Market Needs To Ramp Up Cloud Security and How You Can Help Them Get There
