Vulnerabilities / Threats

4/12/2016
09:45 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Zero-Day Discoveries A Once-A-Week Habit

Symantec threat report shows growth in zero-day vulns to enable more targeted attacks.

A new zero-day vulnerability was discovered every week in 2015, with attackers increasingly homing their crosshairs on Adobe Flash, according to the latest Internet Security Threat Report (ISTR) released today by security researchers at Symantec.

The report took a broad-based look at the biggest trends in cyberattack techniques and breach trends in the last year, with some startling vulnerability statistics bubbling up in the findings. Chief among them that new zero-day vulnerability discoveries jumped by 125% in 2015, even as the total number of new vulnerabilities reported and patched actually decreased by 15% compared to 2014.  

The sharp rise in zero days showed how economic incentives are shaping vulnerability-hunting and exploit for the bad guys.

"Given the value of these vulnerabilities, it’s not surprising that a market has evolved to meet demand," the ISTR said. "Targeted attack groups exploit the vulnerabilities until they are publicly exposed, then toss them aside for newly discovered vulnerabilities."

The report found that four of the top five most exploited zero-day vulnerabilities were those found in Adobe Flash, which Symantec researchers pegged as being software whose days are numbered due to security woes.

"From a security perspective, we expect Adobe Flash will gradually fall out of common usage over the next year," the report said.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Many of these targeted zero-day attacks are delivered by way of spearphishing campaigns, which Symantec reports increased by 55% last year. According to the firm, large companies subjected to targeted spear-phishing campaigns see an average of 3.6 successful attacks per campaign. Though targeted spearphishing attacks are distributed across all sectors and business sizes, the largest distribution appears to be among finance, insurance, and real estate firm. Meanwhile, those firms with over 2,500 employees were at higher risk of being targeted.

In addition to spearphishing, targeted attackers also continue to lean heavily on watering-hole attacks that exploit compromised websites to deliver malware to unsuspecting visitors.

"Sophisticated watering-hole attacks, using compromised websites, activate only when a visitor to that website originates from a particular IP address," the report explained. "Reducing collateral damage in this way makes it less likely that the covert attack is discovered. Moreover, this approach also makes it more difficult for security researchers who may visit the website from a different location."

Watering-hole attacks are made easy to execute given the number of holes found within the average web property today. According to Symantec, 78% of websites today suffer from vulnerabilities, with one in seven of those being critical vulnerabilities that allow malicious code to be run without any user interaction. These are numbers that Symantec has said have held pretty steady over the last few years, suggesting that website owners are not making progress on the problem.

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10727
PUBLISHED: 2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive ...
CVE-2018-8018
PUBLISHED: 2018-07-20
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a spe...
CVE-2018-14415
PUBLISHED: 2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVE-2018-14418
PUBLISHED: 2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVE-2018-14419
PUBLISHED: 2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.