Symantec Logged 286 Million New Threats In 2010

Last year will likely go down as the year of the targeted attack, with the litany of big-name breaches that began with Google's revelation that it had been hit by attackers out of China and the game-changer Stuxnet. But it was also a record-breaking year for new malware and variants, with 286 million new samples identified by Symantec.

The newly published Symantec Internet Security Threat Report Trends for 2010 counted some 6,253 new bugs -- the most ever in a year -- that were mostly driven by malware attack toolkits. The ease of deployment that comes with these kits resulted in some 286 million new malware variants, according to Symantec.

"A lot of times [the attacks] were using staged downloaders," says Mark Fosse, executive editor of the Symantec Internet Security Threat Report. "With Zeus, [for example], it's generally through a kit, and it's customizable. Every time someone creates their own customization to Zeus, it creates a new variant.

"This is the single biggest sign that desktop antivirus isn't enough anymore," Fosse says.

Symantec saw a 93 percent increase in Web-based attacks, mainly driven by Web attack toolkits. That's nearly twice the number of attacks on Web applications last year. "A big chunk of this increase came from some single large events," such as the Chinese website that were compromised, he says.

There were 14 zero-day flaws, including four for Stuxnet, in 2010.

In another indication that mobile is the next big target, Symantec counted 163 vulnerabilities, up from 115 in 2009. This near-40 percent jump included more Trojans on mobile platforms, Fosse says. But no major attacks on mobile platforms have occurred -- yet, he says. "In the next year or two, we're going to see [Trojans and other attacks] starting to emerge" with the increased use in enterprises of mobile devices, he says.

"Once there's a sufficient financial motive, [attackers] will focus more on mobile," he says.

Symantec also reported some interesting data, such as the price of a credit card in the black market, which is anywhere from 7 cents to $100; one botnet spotted by Symantec was selling 10,000 bots for $15. "Botnets are getting pretty cheap in the grand scheme of things," Fosse says.

And the average number of identities exposed per breach in 2010 was 260,000.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.