Selected quotes from Symantec Global Internet Security Threat Report Volume XV

MrBrian · Apr 27, 2010

Symantec Global Internet Security Threat Report Volume XV is a goldmine of security landscape information. The 97 page report can be downloaded in a link on this page.

This first post lists selected quotes from the sections Threat Activity Trends and Vulnerability Trends.

Of the top-attacked vulnerabilities that Symantec observed in 2009, four of the top five being exploited were client-side vulnerabilities that were frequently targeted by Web-based attacks. Two of these vulnerabilities were in Adobe Reader, while one was in Microsoft Internet Explorer and the fourth was in an ActiveX control. This shows that while vulnerabilities in other network services are being targeted by attackers, vulnerabilities in Web browsers and associated technologies are favored. This may be because attacks against browsers are typically conducted through the HTTP protocol that is used for the majority of Web traffic. Since so much legitimate traffic uses this protocol and its associated ports, it can be difficult to detect or block malicious activity using HTTP.
Click to expand...

The top attacked vulnerability in 2009 was the Microsoft Windows SMB2 ‘_Smb2ValidateProviderCallback()’ Remote Code Execution Vulnerability. Publicly announced in September 2009, this vulnerability was initially believed to be a DoS vulnerability that would let attackers crash Windows. However, within a week it was discovered that the vulnerability could let attackers execute arbitrary code and completely compromise affected computers. A number of publicly and commercially available exploits for the vulnerability were subsequently released. In October 2009, Microsoft released patches to address the vulnerability.

The vulnerability is limited to Windows Vista, Windows Server 2008, and pre-release versions of Windows 7. The security features in these newer versions have been an obstacle for attackers, who have thus far relied on vulnerabilities in third-party software such as Web browsers and browser plug-ins to gain a foothold on these new versions. However, a successful exploit of this vulnerability will compromise the affected computer at the kernel level, which could let attackers install rootkits once the computer has been compromised. These factors could indicate that attackers are increasingly targeting newer versions of the Windows operating system. Additionally, since the attacker does not need to entice the victim to perform actions such as visiting a malicious Web page, it is possible for attackers to scan the Internet for potential targets and initiate attacks at random. Since the attack can be automated at little cost to the attacker, they can reach a large number of publicly facing targets that are affected by the vulnerability. This is in contrast to the other vulnerabilities on the top five, which are client-side in nature. Client-side vulnerabilities can be used to attack harder to reach targets on the internal network of an organization. The top attacked vulnerability from 2008 could also be exploited in the same automated fashion. When vulnerabilities possess the characteristics necessary to facilitate automated scanning and exploitation, attackers will continue to capitalize on them.
Click to expand...

Among the vulnerabilities discovered in 2009, a vulnerability affecting both Adobe Reader and Flash Player was the second most attacked vulnerability. This was also one of four zero-day vulnerabilities affecting Adobe plug-ins during 2009. Two of the vulnerabilities were in the top five attacked vulnerabilities for 2009. Additionally, Adobe vulnerabilities have been associated with malicious code attacks such as the Pidief.E Trojan. Symantec observed the use of targeted PDFs for Trojan attacks earlier in the year. Among the vulnerabilities discovered in 2008, a vulnerability in Java SE was the second most attacked vulnerability. Ultimately, both security researchers and attackers have diverted their efforts to these platforms.
Click to expand...

The top Web-based attacks observed in 2009 primarily targeted vulnerabilities in Internet Explorer and applications that process PDF files. Because these two technologies are widely deployed, it is likely that attackers are targeting them to compromise the largest number of computers possible. As is discussed in the “Web browser vulnerabilities” discussion in this report, Mozilla Firefox had the most reported vulnerabilities in 2009, with 169, while Internet Explorer had just 45, yet Internet Explorer was still the most attacked browser. This shows that attacks on software are not necessarily based on the number of vulnerabilities in a piece of software, but in its market share and the availability of exploit code as well.
Click to expand...

The most common Web-based attack observed in 2009 was related to malicious PDF activity, which accounted for 49 percent of Web-based attacks. This is a sizeable increase from 11 percent in 2008.
Click to expand...

In 2009, the second most common Web-based attack was associated with the Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness, which accounted for 18 percent of the global total— a decrease from 2008 when this vulnerability accounted for 30 percent of the total during that reporting period. This vulnerability allows attackers to install malicious files on a vulnerable computer when a user visits a website hosting an exploit. To carry out this attack, an attacker must exploit an arbitrary vulnerability that bypasses Internet Explorer security settings. The attacker can then execute malicious files installed by the initial security weakness. This vulnerability was disclosed on August 23, 2003, and fixes have been available since July 2, 2004. This indicates that a large percentage of computers are not being adequately patched in a timely manner.
Click to expand...

Many of the vulnerabilities observed through Web-based attacks in 2009 have been known and patched for some time. For example, the Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness was published on August 23, 2003, and fixes have been available since July 2, 2004, yet it remains the second-ranked Web-based attack. This is likely because of the use of Web attack kits like Fragus, Eleonore, and Neosploit. These kits come bundled with a variety of different exploits, including some exploits for older vulnerabilities. Because an older vulnerability is likely to be included in more kits, it will probably be seen in more attacks than many of the newer vulnerabilities.
Click to expand...

That said, the shifting market share should not significantly endanger browsers other than Internet Explorer in terms of attacks in the wild as it is unlikely that a tipping point has yet been reached that will make the development of concerted attacks on other browsers sufficiently profitable to be viable.
Click to expand...

While ActiveX vulnerabilities are currently on the decline, vulnerabilities in other plug-in technologies such as Java SE and Adobe Reader are on the rise. The prior focus on ActiveX vulnerabilities among security researchers and attackers was due to the ubiquity of ActiveX technologies as a whole—mostly because of the high market share of Internet Explorer. However, the vulnerabilities themselves were scattered among hundreds of disparate vendors. In contrast, Java SE and Adobe Reader are not only ubiquitous, but they are cross-browser and cross-platform technologies.
Click to expand...

Of all browsers Symantec analyzed in 2009, Safari had the longest window of exposure (the time between the release of exploit code for a vulnerability and a vendor releasing a patch), with a 13-day average; Internet Explorer, Firefox, and Opera had the shortest windows of exposure in 2009, averaging less than one day each.
Click to expand...

In 2009, Symantec documented 12 zero-day vulnerabilities, which is more than the nine zero-day vulnerabilities documented in 2008. In 2009, there was some diversification in the types of zero-day vulnerability documented. In previous years, Symantec observed a trend toward targeting Microsoft Office suite and Internet Explorer. In 2009, four zero-day vulnerabilities were related to Adobe Reader, while six were related to various Microsoft components including DirectX, IIS, and Office. Additionally, there were no “region-specific” applications targeted in 2009, as was seen in previous years. It may be that attackers no longer view attacks on region-specific applications as profitable.
Click to expand...

Financially motivated attacks against both enterprises and individuals remain a large part of the threat landscape. The underground economy continues to flourish even while the mainstream economy begins recovering from the financial crisis. Many cybercriminals have shifted their efforts toward creating kits they can sell to new entrants in the underground economy. This enables relatively inexperienced attackers with little technical knowledge to mount attacks without too much difficulty. As these developments make it easier for more attackers to enter into the online underground economy, Symantec expects attacks against Web browsers and malicious code variants installed through these attacks to increase. This increases the importance of reputation-based security techniques and other technologies that act to catch malicious code beyond simple signature-based detection.
Click to expand...

MrBrian · Apr 27, 2010

This post lists selected quotes from the section Malicious Code Trends.

In 2009, Symantec created 2,895,802 new malicious code signatures. This is a 71 percent increase over 2008, when 1,691,323 new malicious code signatures were added. Although the percentage increase in signatures added is less than the 139 percent increase from 2007 to 2008, the overall number of malicious code signatures by the end of 2009 grew to 5,724,106. This means that of all the malicious code signatures created by Symantec, 51 percent of that total was created in 2009. This is slightly less than 2008, when approximately 60 percent of all signatures at the time were created.
Click to expand...

The slight decline in the rate of growth should not discount the significant number of new signatures created in 2009. Signature-based detection is lagging behind the creation of malicious threats—something which makes newer antivirus technologies and techniques, such as behavioral-based detection, increasingly important. For example, of the threat instances that Symantec’s reputation-based techniques protected users from in 2009, approximately 57 percent corresponded to singletons. This finding is consistent with the overall observation that malicious code authors are creating unique threats using techniques such as packing, obfuscation, and server-side polymorphism. This trend suggests that security technologies that rely on signatures should be complemented with additional heuristics, behavioral monitoring techniques, and reputation-based security. Moreover, with the advent of malicious software toolkits (such as Zeus), relatively inexperienced users can quickly create targeted threats.
Click to expand...

In 2009, there were six Trojans, three worms, and one virus in the top 10 new malicious code families detected. Two of the three worms include a back door component. Volume XII of the Symantec Global Internet Security Threat Report noted that the growing prevalence of Trojans is indicative of multistage attacks. A multistage attack typically involves an initial compromise followed by the installation of an additional piece of malicious code, such as a Trojan that downloads and installs adware. As with 2008, in 2009 four of the top 10 new malicious code families downloaded additional threats.
Click to expand...

During this reporting period, the overall volume of the top 50 potential malicious code infections doubled from 2008 to 2009; therefore, decreases in percentages do not likely indicate a year-over-year decline in potential infections. As in previous reporting periods, Trojans composed the highest percentage of the volume of the top 50 potential malicious code infections, although the percentage dropped from 68 percent in 2008 to 56 percent in 2009.
Click to expand...

The second highest percentage of the top 50 potential malicious code infections for 2009 belonged to worms, which increased to 43 percent from 29 percent in 2008. Six of the top 10 threats in 2009 had worm components, compared with only four in 2008.
Click to expand...

Viruses made up the third highest percentage of the top 50 potential malicious code infections in 2009 increasing to 32 percent in 2009 from 19 percent previously.
Click to expand...

Back doors continued to decline in 2009, dropping from 15 percent in 2008 to 13 percent in 2009. In 2008, there were two threats with back door components in the top 10. In 2009, Downadup was the only sample in the top 10 with a back door component to it.
Click to expand...

Staged downloaders are threats that download and install other malicious code onto a compromised computer. These threats allow attackers to alter the downloadable component to any type of threat to suit their changing objectives over time. For example, attackers can install a Trojan that relays spam, rather than one that steals confidential information. As the attackers’ objectives change, they can change any later components that will be downloaded to perform the requisite tasks. Of the top 50 potential malicious code infections, 75 percent downloaded additional threats, down from 79 percent in 2008.
Click to expand...

Many of the top downloaded components in 2009 were similarly ranked in 2008, indicating that these families continue to be prevalent and effective threats. In 2008, six of the 10 most downloaded components involved password stealing, keystroke logging, or advertisement promotion. In 2009, this has increased to nine of the top 10 most downloaded components, strongly indicating that profit continues to be the driving motivation for malicious code authors.
Click to expand...

In 2009, four of the top 10 most prevalent malicious threats observed expose confidential information or provide remote access. Three of the top 10 new threats directly expose information, while four are staged downloaders that might also expose information, depending on the downloaded components. Operators in the underground economy use these malicious threats to gain access to banking and credit card information, online credentials, and to target specific enterprises.
Click to expand...

In 2009, 98 percent of confidential information threats had a remote access component. This was an increase from 83 percent in 2008. The continued increase is likely because the addition of remote access features (as well as other confidential information threats) to malicious software has become fairly simple for authors to do; thus, almost all new threats include them. The sophistication and effectiveness of malicious software creation toolkits has also likely contributed to the increase.
Click to expand...

Malicious code that exports user data accounted for 89 percent of threats to confidential information in 2009, up from 78 percent in 2008. This is unsurprising since threats that attempt to steal bank account information, authentication credentials, and other confidential information could lead to monetary gain.
Click to expand...

Confidential information threats with a keystroke logging capability made up 86 percent of threats to confidential information, up from 76 percent in 2008. Malicious code incorporating keystroke loggers that target online gaming account credentials continues to be popular.
Click to expand...

Overall, every category of threats to confidential information increased in 2009. This is considered to be due to the continuing increased professionalization of the threat landscape. The creation of toolkits designed specifically to create malicious packages is making it relatively easy for even neophyte attackers to create threats with increasing complexity and sophistication over time.
Click to expand...

In 2009, 72 percent of potential malicious code infections propagated as file-sharing executables, up from 66 percent in 2008. File-sharing executables are the propagation mechanisms employed by viruses and some worms to copy themselves onto removable media. The continuing resurgence in this vector over the past few years coincides with the increased use of removable drives and other portable devices. It is also an easy vector to exploit because old malicious code developed for floppy disks can be easily modified for current removable media devices.
Click to expand...

In 2009, 42 percent of malicious code that propagated did so through the CIFS protocol, up from 30 percent in 2008. Propagation through the CIFS protocol overtook propagation through email in 2009. The increase may be linked to the diversification of mechanisms discussed above. Three of the top 10 malicious code threats for 2009 employed the CIFS propagation mechanism, up from two in 2008.
Click to expand...

Propagation occurring through email attachments dropped from 31 percent in 2008 to 25 percent in 2009, continuing its decline from 32 percent in 2007. Email attachments have now been surpassed by both executable file sharing and CIFS propagation methods.
Click to expand...

The propagation of malicious code by remotely exploiting vulnerabilities doubled between 2008 and 2009. In 2009, 6 percent of the 1,560 documented malicious code instances exploited vulnerabilities. This is an increase from the 3 percent proportion of the malicious code instances documented for 2008. In 2009, four of the top 50 global malicious threats exploited vulnerabilities, up from three in 2008. The effectiveness of this method of propagation is borne out by the fact it was the fourth-ranked propagation mechanism in both 2008 and 2009.
Click to expand...

The success of Downadup illustrates that, even though there are small numbers of samples that exploit vulnerabilities, they have great success in compromising unpatched computers. End users and enterprises should ensure that vulnerabilities in affected software are patched as soon as fixes are available.
Click to expand...

MrBrian · May 1, 2010

This last post lists selected quotes from the section Phishing, Underground Economy Servers, and Spam Trends.

It is not surprising then that, given its gainful capability, the majority of phishing activity targets brands in the financial sector. The prosperous nature of these phished credentials is borne out by the fact that credit card details and banking credentials remained the most frequently advertised items on underground economy servers observed by Symantec in 2009.
Click to expand...

As previously mentioned, the number of brands targeted by phishing attacks in 2009 decreased by 13 percent when compared to 2008. An increase in the number of phishing URLs targeting fewer brands may indicate that phishers narrowed the focus of their phishing attacks during 2009. This becomes evident when the top phished brands in 2009 are compared with the same brands phished in 2008. In 2009, the top two brands phished belonged to the largest U.S.-based multinational banks. In 2008, these brands ranked 17th and seventh in 2008, respectively. There was nearly a sevenfold increase in phishing URLs that targeted the top-phished brand in 2009 over the previous reporting period, while the second-ranked brand had almost a threefold increase. This indicates that phishers are narrowing their focus. Rather than targeting a wider range of smaller financial institutions, they are specifically targeting the largest banks that are more likely to have a higher number of customers banking online.
Click to expand...

In 2009, credit card information was the good most frequently advertised for sale on underground economy servers observed by Symantec, accounting for 19 percent of all advertised items. This was a decrease from 32 percent in 2008.
Click to expand...

While there was a decline in credit card advertisements in 2009, it is likely that they will continue to be a significant factor in the underground economy. With the wide availability of the previously mentioned crimeware kits, it is becoming easier for neophytes to operate in the online underground economy. This will likely increase the availability of credit cards on underground economy servers.
Click to expand...

Bank account credentials were the second most commonly advertised item on underground economy servers observed by Symantec in 2009, accounting for 19 percent of all advertised goods. This was the same percentage as was observed in 2008.
Click to expand...

The third most common item advertised for sale on underground economy servers observed by Symantec in 2009 was email accounts, making up 7 percent of the total. This was an increase from 5 percent in 2008. Having access to stolen email accounts has many benefits for criminals. The accounts can be used for sending out spam and/or harvesting additional email addresses from contact lists. Recipients of spam email coming from a known email address may be more likely to trust the validity of the message.
Click to expand...

In 2009, botnets were responsible for approximately 85 percent of all spam observed by MessageLabs Intelligence.
Click to expand...

Log in or Sign up

Selected quotes from Symantec Global Internet Security Threat Report Volume XV

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Log in or Sign up

Selected quotes from Symantec Global Internet Security Threat Report Volume XV

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Useful Searches