Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Zero-Day Attacks Top Security Threat List

For the big picture on IT security, consider what the influential SANS Institute calls the two most important trends this year: a dramatic surge in zero-day attacks and multiple exploits of Microsoft Office. Oh, and keep an eye on voice-over-IP attacks.

A zero-day attack?

A zero-day attack?

The SANS Institute last week released its annual top 20 threats list (available at The increase in zero-day attacks--software bugs for which there are no patches--is the result of a fundamental change toward smaller, more targeted attacks. Criminals value zero-day attacks because they want to slip Trojan horse code undetected onto computers for a specific purpose, rather than send mass-havoc worms, says Roger Cumming, director of the United Kingdom's National Infrastructure Security Coordination Center.

A related trend is the big jump in attacks exploiting vulnerabilities in Microsoft's Office suite. Those attacks, which began in May with a zero-day assault against Word, continued through the summer, with Microsoft repeatedly patching the apps. Qualys, a security researcher and SANS list collaborator, says Office vulnerabilities tripled, and about 20% were zero-day vulnerabilities.

VoIP, meanwhile, is a risk to watch. Researchers worry about it being used to attack the conventional phone network. "The traditional phone network has never been accessible to hackers directly," says Rohit Dhamankar, senior manager of security research at 3Com's TippingPoint, "but if you can compromise a [VoIP] server, there's a chance you can craft special messages to the traditional network, perhaps crash the network."