Attacks/Breaches

2/7/2017
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Point-of-Sale Malware Declined 93% Since 2014

SonicWall study highlights alarming growth in ransomware incidents.

Science dictates that for every action there's a reaction.

That's one of the main points of a new SonicWall study, which reports a 93% decline in point-of-sale (PoS) malware creation since 2014, but counters that news with a reality-check that ransomware grew by a rate of 167 times year-over-year.

The study, conducted by the SonicWall Global Response Intelligent Defense (GRID) Threat Network, found that ransomware was the payload of choice for malicious email campaigns and exploit kits. Ransomware attack attempts went from 4 million in 2015 to a staggering 638 million last year.

"It's pretty clear that the move to chip-and-PIN credit cards decreased PoS malware over the past couple of years," says Dmitriy Ayrapetov, executive director of product development at SonicWall. "This is a dramatic drop compared to 2014, which was the high point of PoS malware, the time that top retailers like Target, Home Depot, and Staples were hit with massive data breaches."

Ayrapetov adds that cybercriminals go where the money is, and during the last year, ransomware has become a very profitable business.

"With ransomware, attackers can hit both small and large businesses," Ayrapetov says. "And it's a lot less risky, since the attackers get paid in bitcoins and don't have to use a credit card. Also, the emergence of ransomware-as-a-service has reduced the barrier to entry, [so] anybody can purchase ransomware-as-a-service now."

The SonicWall study also found that SSL/TLS traffic grew by 38% last year, partly due to the growth in cloud application adoption. But yet again, the increase in SSL/TLS traffic has created another flaw: an uninspected backdoor into the network that cybercriminals can potentially exploit.

"Companies now need to look inside the network and inspect and protect encrypted traffic," says Mike Spanbauer, vice president of security, test & advisory at NSS Networks, which had an early briefing on the SonicWall report. "It's really not terribly difficult to make money spreading ransomware. You can now get service agreements. It’s really scary how accomplished a business model they have."

Other findings of the SonicWall study:

On the plus side: Dominant exploit kits, Angler, Nuclear, and Nutrino disappeared in mid-2016; unique malware samples fell to 60 million in 2016 compared with 64 million in 2015, a 6.25% decrease, while total attack attempts dropped to 7.87 billion in 2016, down from 8.19 billion in 2015.

On the minus side: IoT devices were compromised on a massive scale, leading to numerous DDoS attacks, most notably, the attack on DNS provider Dyn last fall; Android devices saw increased security protections, but remained vulnerable to overlay attacks.

The SonicWare GRID Threat Network is based on more than 1 million sensors placed in more than 200 countries and territories. The GRID Threat Network monitors traffic 24x7x365, developing its analysis on more than 100,000 malware samples collected daily. 

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.