syssec_red_book

4. Software Vulnerabilitiesinformation. Numerous security breaches in high-profile online services haveresulted in unauthorized access to whole databases with millions of entriesconsisting of usernames, passwords, financial information, and other privatedata [26, 50, 59, 61].4.2 Who Is Going to Be Affected?An ever increasing part of our business, social, and personal life involves onlineservices and software running on personal devices and equipment that weuse or depend on. Therefore, the risk of exploitable software vulnerabilitiescan affect all of us. Even people or organizations who do not engage inonline interactions or who even do not use any computing devices at all canbe affected, as software controls major parts of critical infrastructures. Forinstance, the massive outbreak of the Conficker worm at the beginning of 2009resulted in more than 10 million infected machines worldwide [319]. Amongthe millions of infected computers were machines in the Houses of Parliamentin London [286] and the Manchester City Council [254]. Just in the latter case,the infection cost an estimated £1.5 million in total. After a security breachat LinkedIn, a popular social networking service for people in professionaloccupations, the (weakly) encrypted passwords of more than 6.4 million userswere exposed [26].4.3 What Is Expected to Happen?Although decades of research and development insecure programming and software protections havematerialized in most of the widely used operatingsystems and applications, experience has shownthat the rate of discovery of software vulnerabilitieskeeps increasing. Given the professionalism anddetermination of criminals and other threat agents,and the ever increasing complexity and interdependenceof current software systems, it is expected that software vulnerabilitieswill not be eradicated anytime soon. At the same time, the increasing sophisticationof recent exploits [101, 304] is an indication that the detectionand mitigation of future threats will become harder as a result of the moreprevalent use of evasion techniques and stealthy attacks.4.4 What Is the Worst That Can Happen?Besides compromising the security and privacy of our digital interactions,software vulnerabilities can put at risk other parts of our daily activities, oreven our lives. In the same way a worm subverted industrial systems withinIran’s nuclear facilities [250], an extremist group could attempt to compromise30