Hacking: The Next Generation

Summary

In this chapter, we examined the crafty and emerging attack techniques that today’s new age of sophisticated attackers are employing. Whether they’re conducting complex XSS attacks, turning the perimeter inside out by way of CSRF, abusing domain-based content ownership issues, or exploiting the browser software itself, attackers are evolving and learning how to poke holes into the corporate perimeter, turning it into a porous castle. As we demonstrated in this chapter, these exploits are less focused on compromising or infecting entire systems and more focused on stealing corporate secrets and data. This shift in focus allows attackers to bypass all the typical security strategies and protection mechanisms that modern software and information systems employ. Typical protection measures, such as SSL, VPNs, strong password policies, expensive firewalls, and even fully patched systems, will not stop many of these attacks. These exploits will not trigger antivirus alerts, nor will they leave an easy forensic trail for investigators to follow. In most cases, once the attacker has successfully carried out the exploit, the victim experiences no noticeable change, as the system has no persistent change to detect.

We sincerely hope that the material we presented in this chapter raises awareness of the new breeds of attack vectors that criminals are employing today, and that organizations use this information to enforce proactive measures to better protect their customers and data ...