Symantec Internet Security Threat Report

MrBrian · May 2, 2008

Symantec has some very nice reports available about Internet security trends over a 6 month period. The latest full report is 99 pages, while the latest abridged version is 36 pages. Here are some interesting quotes from the report:

Not including site-specific vulnerabilities, Symantec documented 2,134 vulnerabilities in the second half of 2007, 13 percent less than the first half of 2007.
Click to expand...

Seventy-three percent of vulnerabilities documented in this period were classified as easily exploitable, compared to 72 percent in the first half of 2007.
Click to expand...

Easily exploitable vulnerabilities:

This metric covers vulnerabilities that attackers can exploit with little effort based on publicly available information. The vulnerability analyst assigns an exploit availability rating after thoroughly researching the need for and availability of exploits for the vulnerability.

This metric replaces the “Ease of exploitation” metric (in the Symantec Internet Security Threat Report prior to Volume XI), to accommodate Symantec’s adoption of the exploitability rating in the Common Vulnerability Scoring System (CVSS) V1.0.

CVSS classifies all vulnerabilities into one of four possible categories:

Unconfirmed: Would-be attackers must use exploit code to make use of the vulnerability; however, no such exploit code is publicly available.

Proof-of-concept: Would-be attacks must use exploit code to make use of the vulnerability; however, there is only proof-of-concept exploit available that is not functional enough to fully exploit the vulnerability.

Functional: This rating is used under the following circumstances:
• Exploit code to enable the exploitation of the vulnerability is publicly available to all would-be attackers; and/or,
• Would-be attackers can exploit the vulnerability without having to use any form of exploit code; In other words, the attacker does not need to create or use complex scripts or tools to exploit the vulnerability.

High: The vulnerability is reliably exploitable and there have been instances of self-propagating malicious code exploiting the vulnerability in the wild.

For the purposes of this report, the last two categories are considered “easily exploitable” because the attacker requires only limited sophistication to exploit the vulnerability. The first two categories are considered more difficult to exploit because attackers must develop their own exploit code or improve an existing proof-of-concept to make use of the vulnerability.
Click to expand...

denniz · May 4, 2008

I was kinda amused to read these 2 statements, because most of the time you read the exact opposite.

All operating system vendors except Apple® and Sun® had shorter average patch development times. Microsoft® had the shortest patch development time, at six days; Sun had the longest patch development time, at 157 days.
Click to expand...

During the second half of 2007, there were 88 vulnerabilities reported in Mozilla browsers, 22 in Safari, 18 in Internet Explorer, and 12 in Opera. In the previous six month period, Internet Explorer was subject to 39 vulnerabilities, Mozilla to 34, Safari to 25, and Opera to seven
Click to expand...

MrBrian · May 4, 2008

denniz said:

I was kinda amused to read these 2 statements, because most of the time you read the exact opposite.
Click to expand...

Things can change rapidly in the malware world....

If you like this type of report, also see a free report of similar length called Microsoft Security Intelligence Report. ~removed un-necessary dribble....Bubba~

Log in or Sign up

Symantec Internet Security Threat Report

MrBrian Registered Member

denniz Registered Member

MrBrian Registered Member

Log in or Sign up

Symantec Internet Security Threat Report

MrBrian Registered Member

denniz Registered Member

MrBrian Registered Member

Useful Searches