Vulnerabilities / Threats
12/6/2012
02:21 PM
Dark Reading
Dark Reading
Slideshows
Connect Directly
RSS
E-Mail
50%
50%

Slide Show: Top 10 Malware Advances In 2012

Blackhole's business model, Flashback's Mac fetish, ransomware's resurgence with Reveton, and Gauss' ability to guard against analysis among the game-changers this year
Previous
1 of 11
Next


It's frequently said that cybersecurity is an arms race, with defenders constantly adapting to attackers, and attackers finding ways to better evade their target's defenses.

For malware in 2012, the analogy is an apt one. Malicious programs continually evolved in 2012, whether using new technical approaches to infection, novel business models, or demonstrating the vulnerability of areas thought unrelated to cybersecurity. Flashback demonstrated that the Mac OS X had become a viable target for cybercriminals, while the Blackhole Exploit Kit refined the crime-as-a-service business model.

Malware also became a tool of nations in 2012, in many cases aimed at gathering intelligence in the Middle East. While previous years had hinted that nation-states would develop malware as one weapon in their arsenal, half of this year's list of malware was used for political aims. The Da Vinci Trojan illustrated that governments had taken to buying malware for surveillance, while Flame and Gauss hinted at what well-funded adversaries could accomplish. Many other malicious attacks had political aims, even if they were not carried out by governments, says Liam O Murchu, manager of operations for Symantec's security response group.

"We are seeing different motivations coming into play -- that is, revenge or hacktivism," Murchu says. "We don't see the attacks done for as much of a profit motivation, but for political reasons."

Graphic: Kaspersky Lab

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.