{"id":21052,"date":"2017-09-18T16:13:43","date_gmt":"2017-09-18T16:13:43","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2017\/09\/18\/report-government-among-most-targeted-for-web-application-attacks\/"},"modified":"2026-08-08T04:53:38","modified_gmt":"2026-08-08T04:53:38","slug":"report-government-among-most-targeted-for-web-application-attacks","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/it-networks\/2017\/09\/18\/report-government-among-most-targeted-for-web-application-attacks\/","title":{"rendered":"Report: Government among most targeted for web application attacks"},"content":{"rendered":"\n

Government remained among the most targeted industries for web application attacks during the second quarter of 2017, according to recent data released by cybersecurity company Positive Technology.<\/p>\n\n\n\n

The report details the most common types of web application attacks by industry sector, as well as the objectives, intensity and time distribution of web application attacks. The report compares Q2 2017 data to data from previous quarters to draw out trends.<\/p>\n\n\n\n

Key Findings<\/b><\/p>\n\n\n\n

At 1,184 average attacks per day, government followed only the IT sector (1,346) as the most targeted industry for web application attacks in Q2 2017.<\/p>\n\n\n\n

Across all industries, cross-site scripting (XSS) attacks occurred most frequently, comprising 39.1 percent of all attacks. Researchers noted that XSS attacks were \u201cconsistently high\u201d throughout Q2, with 100 to 250 recorded every day.<\/p>\n\n\n\n

SQL injection (24.9 percent) was the second most frequent attack. Information leakage (4.6 percent) and XML injection (4.2 percent) remained prevalent across sectors. Researchers noted, \u201cIn Q2, attackers showed more interest in attacks on application users. Most attacks were intended to access sensitive information.\u201d<\/p>\n\n\n\n

Within the government sector specifically, data reflect broader trends. The top attacks included XSS (49 percent), SQL injection (20 percent), information leakage (18 percent) and denial of service (6 percent). Researchers noted that these types of attacks align with threat actors\u2019 motives for targeting the government sector:<\/p>\n\n\n\n\n\n

Within the critical infrastructure sectors of energy and manufacturing, the data diverged slightly from cross-industry averages. SQL injection (48.1 percent), operating system commanding (36.4 percent), server-side template injection (7.8 percent) and path traversal (5.4 percent) were most common. The different methods can be explained by attackers\u2019 motives:<\/p>\n\n\n\n\n\n

Analysis of Findings<\/b><\/p>\n\n\n\n

Perhaps the most interesting finding in the report is an exploit employed against a common vulnerability in two different industries for different purposes.<\/p>\n\n\n\n

Within the energy sector, researchers detected a remote command execution for OS commanding. Threat actors exploited an Apache Struts vulnerability (CVE-2017-5638<\/a>) in the attack. If that vulnerability doesn\u2019t ring a bell, it should. It\u2019s the same vulnerability threat actors used in the Equifax breach.<\/p>\n\n\n