Attacks/Breaches
2/12/2013
09:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Retail Top Of 2012 Breach Investigations List, Web Threats Intensify

Separate annual threat reports from Trustwave and Websense show some persistent security problems

Some things never change: There are more malicious websites and Web threats than ever, mobile is risk-laden, and passwords are still lame and guessable, according to separate threat reports published today. But there's at least one big change: Retailers were the majority of breach investigation cases last year.

Trustwave's 2013 Global Security Report -- based on its incident response investigations, penetration tests, events logged on millions of websites, and Web application attacks -- says that for the first time in three years, retailers were the bulk of its 450 breach investigations, with 45 percent of the cases, followed by food and beverage (24 percent), hospitality (9 percent), financial services (7 percent), and others.

"Retail and food and beverage merchants have vied for the No. 1 cybercrime target for the past several years. So I don't see it as a shift as much as I do simply there were more targets of opportunity in the retail space last year," says Christopher Pogue, director of digital forensics and incident response for Trustwave's SpiderLabs. "The reason both are so popular is that they have an abundance of valuable, easily monetized data to steal in credit card numbers."

Web security is also topping the list of threats, with an increase of 600 percent worldwide in malicious websites, according to Websense's new 2013 Threat Report. That number jumped 720 percent in North America alone, and legitimate Web hosts housed some 85 percent of the malicious URLs.

Chris Astacio, manager of security research for Websense, says this jump has a lot to do with attackers using URLs more than email attachments, since users have become more wary of opening attachments than clicking on links. "People have become more savvy about generic emails with attachments. But in targeted attacks, they are usually socially engineered so they are personalized [and convincing] to the victim," Astacio says.

"Malicious URLs are also exploding because of exploit kids that are more successful and easier for an attacker to use ... for drive-by download [attacks]," he says. The attacks are very efficient, too: Half of Web-connected malware downloads executable files in the first 60 seconds of the infection, according to the report.

The top three malware-hosting countries are, in order, the U.S., Russia, and Germany, while the top three command-and-control hosters are, in order, China, the U.S., and Russia, according to Websense.

Passwords, meanwhile, remain a major weak link. Half of users use easily guessed ones, according to Trustwave's report, with the most popular one being Password1. Welcome1 is the most widely used password among the penetration tests conducted by Trustwave.

"It's human nature to do the bare minimum to be functional. How many people still open up their new wireless router and don't bother to change the SSID or set a password? How many people still use the same password for each and every site they have an account on? How many people still click on email attachments from people they don't know?" Trustwave's Pogue says. "Security is an afterthought. It always has been -- until something bad happens, [and] then it's suddenly 'our top priority.'"

Mobile devices increasingly are becoming a danger zone for organizations: Mobile malware grew by 400 percent last year, mostly for the Android, according to Trustwave's findings. And according to Websense, one in 10 malicious mobile apps asked for permission to install other apps as well.

"You need to look at desktop attacks to understand mobile," Websense's Astacio says. "Mobile is starting to follow the paradigm of a desktop type of infection."

Meanwhile, Trustwave's Pogue says the bottom line is that some of the same attack vectors that plagued security 10 years ago remain problematic. "What surprised me most [about the findings in our report] was that things really aren't changing," he says. "Security weaknesses, like open remote administration, bad passwords, lack of a properly configured firewall, SQL injection, remote file inclusion -- all are easily preventable with a modest investment. There have been such great advances in security technologies and a strong understanding of threat vectors. Businesses just have use them. This is the cost of doing business in today’s world."

The Websense report is available here for download, and the Trustwave report is available here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
2/14/2013 | 5:12:24 AM
re: Retail Top Of 2012 Breach Investigations List, Web Threats Intensify
It's interesting to me that the retail sector is so often the victim of breaches despite the strong requirements of PCI compliance. Readers, what do you think -- does PCI improve retail security, or is it more of a distraction?
--Tim Wilson, editor, Dark Reading
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.