Businesses face new breed of security threats

"Pass the hash" and "metasploit" are two of a breed of emerging security threats facing corporate IT departments.

The key security threats facing businesses range from mutations of established phenomena — such as malware or phishing — to less well-known ones, such as metasploit releases and pass-the-hash attacks.

The most dangerous new security threats were revealed by experts at the RSA security conference in San Francisco this week.

Ed Skoudis, a hacking expert at the Sans Institute, said most security threats stem from the fact that so many applications are now linked to the internet.

He said: "We've web-ified all applications."

Among the less familiar new threats are metasploit releases, which target networks by simultaneously attacking a number of vulnerabilities (up to 200) on different platforms, including Windows, Linux and the iPhone.

Pass-the-hash attacks, which use stolen password hashes to access other systems in a targeted network — avoiding more time-consuming password-cracking — were also singled out.

Although this approach has been around for some time, it is only now that it's becoming prevalent. Skoudis said: "These attacks have been around for years but now the tools are out there."

Website attacks, which plant browser exploits to compromise users, are also becoming more of a problem, as they are able to target well-known, high-traffic sites.

A major threat is browser scripting attacks, which use web browsers to get through corporate firewalls, allowing access to confidential information.

While not a new threat, the development of botnets remains a big security concern because the "fast flux" approach used by attackers to protect their robotic networks is making the life of botnet investigators difficult.

The security experts also warned about the threat of malware being spread through the use of embedded devices, such as memory sticks — now one of the main ways harmful code is brought into businesses.