Vulnerabilities / Threats
12/6/2012
02:21 PM
Dark Reading
Dark Reading
Slideshows
50%
50%

Slide Show: Top 10 Malware Advances In 2012

Blackhole's business model, Flashback's Mac fetish, ransomware's resurgence with Reveton, and Gauss' ability to guard against analysis among the game-changers this year
Previous
1 of 11
Next


It's frequently said that cybersecurity is an arms race, with defenders constantly adapting to attackers, and attackers finding ways to better evade their target's defenses.

For malware in 2012, the analogy is an apt one. Malicious programs continually evolved in 2012, whether using new technical approaches to infection, novel business models, or demonstrating the vulnerability of areas thought unrelated to cybersecurity. Flashback demonstrated that the Mac OS X had become a viable target for cybercriminals, while the Blackhole Exploit Kit refined the crime-as-a-service business model.

Malware also became a tool of nations in 2012, in many cases aimed at gathering intelligence in the Middle East. While previous years had hinted that nation-states would develop malware as one weapon in their arsenal, half of this year's list of malware was used for political aims. The Da Vinci Trojan illustrated that governments had taken to buying malware for surveillance, while Flame and Gauss hinted at what well-funded adversaries could accomplish. Many other malicious attacks had political aims, even if they were not carried out by governments, says Liam O Murchu, manager of operations for Symantec's security response group.

"We are seeing different motivations coming into play -- that is, revenge or hacktivism," Murchu says. "We don't see the attacks done for as much of a profit motivation, but for political reasons."

Graphic: Kaspersky Lab

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3586
Published: 2015-04-21
The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2014-5361
Published: 2015-04-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.

CVE-2014-5370
Published: 2015-04-21
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.

CVE-2014-8111
Published: 2015-04-21
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

CVE-2014-8125
Published: 2015-04-21
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.