third Cyber Security Assessment Netherlands - NCSC

Vulnerability Number of systems Pct
“SSL v2 is insecure and must
not be used”
“Anonymous Diffie-Hellman
(ADH) suites do not provide
authentication”
“NULL cipher suites provide no
encryption”
“Suites with weak ciphers
(typically of 40 and 56 bits)
use encryption that can easily
be broken”
Table 10. SSL configurations
1 (40 bits)
212 (56 bits)
266 (40+56 bits)
194 17,5%
20 1,8%
1 0,1%
43,3%
What primarily appears to be a major problem is that many SSL
systems still support 40 or 56 bits keys to create an encrypted
connection with the client. While this may not happen often in
practice (because the system also supports longer key lengths), the
best practice is to make such weak connections impossible by
changing the configuration. It should be noted at this point that
only systems offering SSL were reviewed. There are many more sites
offering connections that are not secured with SSL.
Defacements
During the period of this Cyber Security Assessment, there were
just under 50,000 defacements of websites in the .nl domain. [194]
In a defacement, the attacker places one of his own pages on a web
server, for example to spread a message or to highlight that a web
server has a vulnerability. Given that attackers often record such
defacements – and possibly the details – on ZoneH, this site
provides valuable information about these defacements and the
attacks behind them.
Unfortunately website defacements seem to be the order of the day:
on average there are around 4,000 defacements to be found on the
.nl domain in ZoneH. This average hides some extremes: for
example in January 2012 there were more than 16,000 defacements,
but just 434 in August 2012. In a few cases, ‘mass defacements’
occurred, where a large number of websites were attacked all at
once through the same vulnerability at one provider.
For example in April 2012, there was an attack on a single IP address
on which 2,789 websites were configured.
Other points that came out from the registration of defacements are:
»»
The biggest vulnerability that was abused to compromise
websites was file inclusion (36 per cent), followed by an attack on
the administrator’s log-in details (8.7 per cent) and SQL injection
(3.2 per cent). In a good 43 per cent of cases there was no record
of the cause.
»»
The vast majority of defacements were against Linux systems:
in a good 61 per cent of the cases, a website used this operating
system. In 30 per cent of the cases, the operating system was not
known. Much further down from Linux come Microsoft Windows
(2.5 per cent) and FreeBSD (2.1 per cent) as platforms used.
»»
The biggest reasons for carrying out a defacement are for fun
(41 per cent) and to be the best defacer (34 per cent). In only
1 per cent of cases did defacement take place because of political
considerations. In 20 per cent of the defacements, the attacker
gave no reason.
Number of registered defacements of .nl websites 2012Q2 - 2013Q1
20000
15000
10000
5000
0
apr '12
may '12
jun '12
jul '12
aug '12
sep '12
oct '12
nov '12
dec '12
jan '13
feb '13
mar '13
Figure 10. Defacements within the .nl domain (source: ZoneH)
194 Source: reports on ZoneH for the .nl-domain.
84