Attacks/Breaches

2/7/2017
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Point-of-Sale Malware Declined 93% Since 2014

SonicWall study highlights alarming growth in ransomware incidents.

Science dictates that for every action there's a reaction.

That's one of the main points of a new SonicWall study, which reports a 93% decline in point-of-sale (PoS) malware creation since 2014, but counters that news with a reality-check that ransomware grew by a rate of 167 times year-over-year.

The study, conducted by the SonicWall Global Response Intelligent Defense (GRID) Threat Network, found that ransomware was the payload of choice for malicious email campaigns and exploit kits. Ransomware attack attempts went from 4 million in 2015 to a staggering 638 million last year.

"It's pretty clear that the move to chip-and-PIN credit cards decreased PoS malware over the past couple of years," says Dmitriy Ayrapetov, executive director of product development at SonicWall. "This is a dramatic drop compared to 2014, which was the high point of PoS malware, the time that top retailers like Target, Home Depot, and Staples were hit with massive data breaches."

Ayrapetov adds that cybercriminals go where the money is, and during the last year, ransomware has become a very profitable business.

"With ransomware, attackers can hit both small and large businesses," Ayrapetov says. "And it's a lot less risky, since the attackers get paid in bitcoins and don't have to use a credit card. Also, the emergence of ransomware-as-a-service has reduced the barrier to entry, [so] anybody can purchase ransomware-as-a-service now."

The SonicWall study also found that SSL/TLS traffic grew by 38% last year, partly due to the growth in cloud application adoption. But yet again, the increase in SSL/TLS traffic has created another flaw: an uninspected backdoor into the network that cybercriminals can potentially exploit.

"Companies now need to look inside the network and inspect and protect encrypted traffic," says Mike Spanbauer, vice president of security, test & advisory at NSS Networks, which had an early briefing on the SonicWall report. "It's really not terribly difficult to make money spreading ransomware. You can now get service agreements. It’s really scary how accomplished a business model they have."

Other findings of the SonicWall study:

On the plus side: Dominant exploit kits, Angler, Nuclear, and Nutrino disappeared in mid-2016; unique malware samples fell to 60 million in 2016 compared with 64 million in 2015, a 6.25% decrease, while total attack attempts dropped to 7.87 billion in 2016, down from 8.19 billion in 2015.

On the minus side: IoT devices were compromised on a massive scale, leading to numerous DDoS attacks, most notably, the attack on DNS provider Dyn last fall; Android devices saw increased security protections, but remained vulnerable to overlay attacks.

The SonicWare GRID Threat Network is based on more than 1 million sensors placed in more than 200 countries and territories. The GRID Threat Network monitors traffic 24x7x365, developing its analysis on more than 100,000 malware samples collected daily. 

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
Cybercriminals Think Small to Earn Big
Dark Reading Staff 3/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.