Hacking: The Next Generation

Summary

The next-generation hacker faces the daunting task of exploiting software that has been hardened against hacker attacks after decades of security lessons learned. As individual software packages are hardened against attacks, attackers will shift focus to nontraditional means of exploitation. These nontraditional means include blended attacks, which take advantage of subtle, all too frequently overlooked security flaws in various pieces of software, combining them into a single devastating attack.

Modern software is intricate and complicated. In today’s environment, well-designed software is built with security in mind. However, very few software packages can claim to defend against blended threats. Each application makes explicit and implicit assumptions as to the environment in which it is operating and the threats against which it was designed to defend. Many of the current security practices, such as threat modeling, do not typically consider threats from third-party applications sharing the same operating system as being in scope. Organizations that consider threats from third-party applications as being in scope have expanded their security efforts exponentially. Even for organizations that attempt to put security mechanisms in place for threats from third-party software, defending against blended threats is still extremely difficult. Behaviors that seem perfectly acceptable may pose a significant security risk when (and only when) they are combined with other benign ...