Vulnerabilities / Threats
12/6/2012
02:21 PM
Dark Reading
Dark Reading
Slideshows
Connect Directly
RSS
E-Mail
50%
50%

Slide Show: Top 10 Malware Advances In 2012

Blackhole's business model, Flashback's Mac fetish, ransomware's resurgence with Reveton, and Gauss' ability to guard against analysis among the game-changers this year
Previous
1 of 11
Next


It's frequently said that cybersecurity is an arms race, with defenders constantly adapting to attackers, and attackers finding ways to better evade their target's defenses.

For malware in 2012, the analogy is an apt one. Malicious programs continually evolved in 2012, whether using new technical approaches to infection, novel business models, or demonstrating the vulnerability of areas thought unrelated to cybersecurity. Flashback demonstrated that the Mac OS X had become a viable target for cybercriminals, while the Blackhole Exploit Kit refined the crime-as-a-service business model.

Malware also became a tool of nations in 2012, in many cases aimed at gathering intelligence in the Middle East. While previous years had hinted that nation-states would develop malware as one weapon in their arsenal, half of this year's list of malware was used for political aims. The Da Vinci Trojan illustrated that governments had taken to buying malware for surveillance, while Flame and Gauss hinted at what well-funded adversaries could accomplish. Many other malicious attacks had political aims, even if they were not carried out by governments, says Liam O Murchu, manager of operations for Symantec's security response group.

"We are seeing different motivations coming into play -- that is, revenge or hacktivism," Murchu says. "We don't see the attacks done for as much of a profit motivation, but for political reasons."

Graphic: Kaspersky Lab

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.