Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
30% of Q4 Malware was New or Zero-Day
Newest First  |  Oldest First  |  Threaded View
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
3/31/2017 | 4:31:33 PM
New ?
I'm not about to dispute that traditional AV misses a good amount of malware.

The proposition that a "30%" failure rate is a realiable benchmark for a universal catch-all benchmark for "traditional AV" - whatever that is nowadays - sounds pretty high to me.

And that "30%" is "new"? "Zero-day" ?

Presumably that 30% includes stuff with the tiniest of code deviations from a long established malware family? Is that really 'new' ?

There's certainly the core of a decent case here. I'm good with that.

Seems to me there's a bit of 'amplification' going on as well, though.

 

 

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/31/2017 | 3:15:42 PM
Level 3's Chris Richter's take.
I recently chitchatted with Level 3's SVP of Global Security Services, Chris Richter, about this very issue in the enterprise cloud context.

He very readily noted that "From a cloud service provider perspective, the one thing they really need to be wary of, and very cognizant of, is that most of the breaches that occurred last year -- the big, big breaches -- did not involve malware at all. They didn't involve any fancy cutting-edge brilliantly written malicious code. It was all mostly zero-day vulnerabilities that the perpetrators were able to take advantage of. In these virtualized cloud environments, that still remains a huge risk, and the cloud operators need to stay ahead. They need to stay ahead of vulnerabilities and they need to have a Plan B should a zero-day attack happen."

He went on to point out the brisk business that zero-day vulnerabilities have on the black market and gray market -- and that many of the WikiLeaks vulnerabilties had already been long-known to the hacker community.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25968
PUBLISHED: 2021-10-19
In “OpenCMS�, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when the...
CVE-2021-20836
PUBLISHED: 2021-10-19
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause information disclosure and/or arbitrary code execution by opening a specially crafted SCS project files.
CVE-2021-41154
PUBLISHED: 2021-10-18
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.1...
CVE-2021-41155
PUBLISHED: 2021-10-18
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix...
CVE-2021-41152
PUBLISHED: 2021-10-18
OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on t...