I'm concerned about the recent spike in Microsoft Silverlight attacks. How much of a threat does Silverlight p...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
Unpatched applications on desktops are one of the most significant challenges in securing traditional client systems, leaving enterprises vulnerable to exploits that could and should be patched to stay secure.
In a blog post, Cisco security researcher Levi Gundert described a popular exploit kit that includes a Silverlight exploit. It was distributed via malicious ads, and the Silverlight vulnerability was used in the exploit to run malicious code on the endpoint. Silverlight has gained market share and is installed on more computers nowadays, so attackers decided it was worth their time to add Silverlight exploits to their exploit toolkits.
The increased use of Silverlight in exploit kits could be attributed to the fact that attackers identified that Silverlight was not being patched regularly and realized that awareness of the software was relatively low, making it an ideal target. Now that Silverlight has been included in a successful exploit kit, other attacks will follow suit and Silverlight will likely start showing up in other exploit kits and be used in more attacks.
When it comes to defending against attacks using Silverlight, addressing only the additional risks from vulnerabilities in Silverlight is ineffective if the other applications installed on a system are not also being kept up to date. Silverlight, like all applications, will require a security patch to address issues that may be exploited in an attack.
When patches are released, enterprises should plan on installing them for all of the systems with sensitive data in a regular and comprehensive cycle. Only installing operating system patches is not sufficient; enterprises should also evaluate their desktop patching process to validate that Silverlight is being patched.
Until organizations keep Silverlight -- and all other applications and systems -- patched and up to date, hackers will continue to exploit the vulnerabilities in it.
Ask the Expert!
SearchSecurity expert Nick Lewis is ready to answer your enterprise threat questions -- submit them now! (All questions are anonymous.)
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Nick Lewis
As the Magento Community Edition suffers a new zero-day vulnerability, expert Nick Lewis explains how it's being exploited and how to mitigate the ...continue reading
Cross-platform malware enables attackers to leverage their attacks using infected Microsoft Word docs. Expert Nick Lewis explains how the attacks ...continue reading
How was the ATMitch malware able to loot cash machines, then delete itself? Expert Nick Lewis explains how the fileless malware works and how it ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.