Nigeria’s 65th in malicious Internet activity – Report

Symantec Corporation has released the Volume 16 of its Internet Security Threat Report (ISTR), which indicated that a massive threat volume of over 286 million as new threats last year, just as Nigeria ranked 65th out of 233 countries monitored by Symantec’s Global Intelligence Network.

The Communications manager at Symantec, Mr. Peter Rae, noted that the report highlighted dramatic increases in both the frequency and sophistication of targeted attacks on enterprises.

“The continued growth of social networking sites as an attack distribution platform; and a change in attackers’ infection tactics, increasingly targeting vulnerabilities in Java to break into traditional computer systems,” he said.

Rae also said that the report explored how attackers are exhibiting a notable shift in focus toward mobile devices.

A press statement made available to ITRealms Online, Mr. Rae said that targeted attacks such as Hydraq and Stuxnet posed a growing threat to enterprises in 2010.

“To increase the likelihood of successful, undetected infiltration into the enterprise, an increasing number of these targeted attacks leveraged zero-day vulnerabilities to break into computer systems. As one example, Stuxnet alone exploited four different zero-day vulnerabilities to attack its targets,” he said.

In 2010, he pointed out that attackers launched targeted attacks against a diverse collection of publicly traded, multinational corporations and government agencies, as well as a surprising number of smaller companies. In many cases, the attackers researched key victims within each corporation and then used tailored social engineering attacks to gain entry into the victims’ networks.

“Due to their targeted nature, many of these attacks succeeded even when victim organizations had basic security measures in place,” he explained.

While the high-profile targeted attacks of 2010 attempted to steal intellectual property or cause physical damage, many targeted attacks preyed on individuals for their personal information, the ISTR cited an instance stating that the report found data breaches caused by hacking resulted in an average of more than 260,000 identities exposed per breach in 2010, nearly quadruple that of any other cause.

“Social network platforms continue to grow in popularity and this popularity has not surprisingly attracted a large volume of malware,” he said, stressing that one of the primary attack techniques used on social networking sites involved the use of Uniform Resource Locator (URLs).

The report further said that under typical, legitimate, circumstances, these abbreviated URLs are used to efficiently share a link in an email or on a web page to an otherwise complicated web address.

Last year, the report added, attackers posted millions of these shortened links on social networking sites to trick victims into both phishing and malware attacks, dramatically increasing the rate of successful infection.

“The report found that attackers overwhelmingly leveraged the news-feed capabilities provided by popular social networking sites to mass-distribute attacks. In a typical scenario, the attacker logs into a compromised social networking account and posts a shortened link to a malicious website in the victim’s status area,” IST report read.

As for the social networking site which automatically distributes the link to news feeds of the victim’s friends, spreading the link to potentially hundreds or thousands of victims in minutes, this was reduced in the year under review.

In 2010, the report said, 65 per cent of malicious links in news feeds observed by Symantec used shortened URLs. “Of these, 73 per cent were clicked 11 times or more, with 33 per cent receiving between 11 and 50 clicks,” Symantec report stated, pointing out that also attack toolkits, software programmes that could be used by novices and experts alike to facilitate the launch of widespread attacks on networked computers, continued to see widespread use.

“These kits increasingly target vulnerabilities in the popular Java system, which accounted for 17 per cent of all vulnerabilities affecting browser plug-ins in 2010. As a popular cross-browser, multi-platform technology, Java is an appealing target for attackers,” ISTR said.

The Phoenix toolkit, the report indicated, was responsible for the most Web-based attack activity in 2010. This kit, as well as many others, incorporates exploits against Java vulnerabilities; whereas the sixth highest ranked Web-based attack during the reporting period was also an attempt to exploit Java technologies.

The number of measured Web-based attacks per day increased by 93 per cent in 2010 compared to 2009. Since two-thirds of all Web-based threat activity observed by Symantec is directly attributed to attack kits, these kits are likely responsible for a large part of this increase.

The major mobile platforms are finally becoming ubiquitous enough to garner the attention of attackers, and as such, Symantec expects attacks on these platforms to increase. In 2010, most malware attacks against mobile devices took the form of Trojan Horse programs that pose as legitimate applications.

While attackers generated some of this malware from scratch, in many cases, they infected users by inserting malicious logic into existing legitimate applications. The attacker then distributed these tainted applications via public app stores. For example, the authors of the recent Pjapps Trojan employed this approach.

ITREALMS Online ... delivering news for ICT4D