Analytics // Threat Intelligence
4/4/2014
08:50 AM
Tim Wilson
Tim Wilson
Quick Hits
Connect Directly
RSS
E-Mail
50%
50%

Advanced Attacks Are The New Norm, Study Says

According to the Websense 2014 Threat Report, most malicious exploits now are advanced and targeted.

Sophisticated attacks are now the rule, rather than the exception, across the Web, according to a study published earlier this week.

According to the Websense 2014 Threat Report, which was issued Thursday, most malicious exploits now are advanced and targeted. "Of the more than 4.1 billion live attacks that Websense technology prevented in 2013, nearly all exhibited techniques to bypass traditional defenses, compromise systems, and persist throughout infected networks in pursuit of confidential data," the study says.

"Cybercriminals continue to evolve their attack planning and execution to stay ahead of most existing security measures," said Charles Renert, vice president of security research for Websense, in a press release. "While the determined, persistent attackers continue to have success in advanced, strategic attacks using zero-day exploits and advanced malware, there has also been a boom in cybercriminal activity on a massive scale. Even these more 'common' forms of attack are easily slipping past organizations without real-time defenses."

Eighty-five percent of malicious links used in Web or email attacks were located on compromised legitimate websites, rather than more easily recognizable malicious sites, Websense says. Thirty percent of malicious executable files sampled included custom encryption of command-and-control communication or data exfiltration.

Websense detected more than 67 million exploit kit events in 2014, the study says. The Magnitude and Neutrino Exploit Kits experienced the largest surge in adoption following the arrest of Blackhole's creator in 2013.

The Zeus malware, which was originally designed as a financial threat and keylogging Trojan, dramatically increased in use as it was repurposed for other vertical markets, Websense says. In the last year, the government and the communications industry joined financial firms among the top five verticals targeted with Zeus malware. The top two industries hit hardest with Zeus attacks were the services and manufacturing sectors, according to the study.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
4/9/2014 | 6:44:34 PM
Re: exploits
But how will the industry market security products without hyperbolic terms like "advanced persistent threat"?
macker490
50%
50%
macker490,
User Rank: Ninja
4/9/2014 | 8:40:32 AM
exploits
we would do well to displose of the terms "advanced" and "sophisticated".    many attacks are simple exploits,   generally of an error in programming.

our focus should be on Quality Control with the object being a standard of Zero Defects in the software development and deployment process.

all the attacker has to do is put the target software into a debugger in then poke it until he finds an error he can make an advantage of.   it is not sophisticated to those whose work this trade. it is something the original authors should have done.  It's called debugging.

not just regression testing.   all branch (structured) testing is required for critical communication components and a good idea for software, generally.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
4/5/2014 | 8:41:57 AM
Re: Advanced Attacks Are The New Norm, Study Says
Hi Tim,

it's normal evolution of time, attacks are becoming events even more sophisticated, APTs are adopting evasion technique very efficient and economies behind each attack advantage the offenders.
A very alarming scenarios.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/4/2014 | 4:26:19 PM
Zero Day Protection
I recently attended a lunch and learn for a vendor pushing out a Endpoint Intrusion Detection System. They intend to have prevention built in by May I believe, but I thought the software was clever and should be prevalent in this conversation. As we know many IDS/IPS systems are signature based which is great once someone detects the signature but for zero days, the signature approach has little effect. This solution focused on individual execution entries and monitored them in real time. Every change made was monitored and analyzed for type, activity, involvement, etc. The GUI was very intuitive and the data provided was extensive. The main point of my story here is that its good to see that defense is making preparations that are not the norm to try and combat attacks of the same nature. If anyone wants to know more because I don't believe one post can cover a software that expansive, please ask and I will elaborate. Anyone see anything similar or another method of trying to successfully block/detect these attacks?
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
4/4/2014 | 12:34:42 PM
Advanced Attacks Are The New Norm, Study Says
Gone are the days when malware simply consisted of annoying popups now you have to worry about phishing sites, keyloggers recording your every stroke. Users have to be ever vigilent concerning their every day internet habits, the seemingly simple banking transaction may be recorded and sent to an attacker who in turn ruins your financial stability and your life. Very sad but this makes the security professional's talents worth more.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.