Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/7/2017
09:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Point-of-Sale Malware Declined 93% Since 2014

SonicWall study highlights alarming growth in ransomware incidents.

Science dictates that for every action there's a reaction.

That's one of the main points of a new SonicWall study, which reports a 93% decline in point-of-sale (PoS) malware creation since 2014, but counters that news with a reality-check that ransomware grew by a rate of 167 times year-over-year.

The study, conducted by the SonicWall Global Response Intelligent Defense (GRID) Threat Network, found that ransomware was the payload of choice for malicious email campaigns and exploit kits. Ransomware attack attempts went from 4 million in 2015 to a staggering 638 million last year.

"It's pretty clear that the move to chip-and-PIN credit cards decreased PoS malware over the past couple of years," says Dmitriy Ayrapetov, executive director of product development at SonicWall. "This is a dramatic drop compared to 2014, which was the high point of PoS malware, the time that top retailers like Target, Home Depot, and Staples were hit with massive data breaches."

Ayrapetov adds that cybercriminals go where the money is, and during the last year, ransomware has become a very profitable business.

"With ransomware, attackers can hit both small and large businesses," Ayrapetov says. "And it's a lot less risky, since the attackers get paid in bitcoins and don't have to use a credit card. Also, the emergence of ransomware-as-a-service has reduced the barrier to entry, [so] anybody can purchase ransomware-as-a-service now."

The SonicWall study also found that SSL/TLS traffic grew by 38% last year, partly due to the growth in cloud application adoption. But yet again, the increase in SSL/TLS traffic has created another flaw: an uninspected backdoor into the network that cybercriminals can potentially exploit.

"Companies now need to look inside the network and inspect and protect encrypted traffic," says Mike Spanbauer, vice president of security, test & advisory at NSS Networks, which had an early briefing on the SonicWall report. "It's really not terribly difficult to make money spreading ransomware. You can now get service agreements. It’s really scary how accomplished a business model they have."

Other findings of the SonicWall study:

On the plus side: Dominant exploit kits, Angler, Nuclear, and Nutrino disappeared in mid-2016; unique malware samples fell to 60 million in 2016 compared with 64 million in 2015, a 6.25% decrease, while total attack attempts dropped to 7.87 billion in 2016, down from 8.19 billion in 2015.

On the minus side: IoT devices were compromised on a massive scale, leading to numerous DDoS attacks, most notably, the attack on DNS provider Dyn last fall; Android devices saw increased security protections, but remained vulnerable to overlay attacks.

The SonicWare GRID Threat Network is based on more than 1 million sensors placed in more than 200 countries and territories. The GRID Threat Network monitors traffic 24x7x365, developing its analysis on more than 100,000 malware samples collected daily. 

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...
CVE-2020-5217
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could b...
CVE-2020-5223
PUBLISHED: 2020-01-23
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3...
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.