Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/5/2011
05:44 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Symantec Logged 286 Million New Threats In 2010

Unique malware and variants galore, and more than 40 percent more mobile vulnerabilities than a year ago

Last year will likely go down as the year of the targeted attack, with the litany of big-name breaches that began with Google's revelation that it had been hit by attackers out of China and the game-changer Stuxnet. But it was also a record-breaking year for new malware and variants, with 286 million new samples identified by Symantec.

The newly published Symantec Internet Security Threat Report Trends for 2010 counted some 6,253 new bugs -- the most ever in a year -- that were mostly driven by malware attack toolkits. The ease of deployment that comes with these kits resulted in some 286 million new malware variants, according to Symantec.

"A lot of times [the attacks] were using staged downloaders," says Mark Fosse, executive editor of the Symantec Internet Security Threat Report. "With Zeus, [for example], it's generally through a kit, and it's customizable. Every time someone creates their own customization to Zeus, it creates a new variant.

"This is the single biggest sign that desktop antivirus isn't enough anymore," Fosse says.

Symantec saw a 93 percent increase in Web-based attacks, mainly driven by Web attack toolkits. That's nearly twice the number of attacks on Web applications last year. "A big chunk of this increase came from some single large events," such as the Chinese website that were compromised, he says.

There were 14 zero-day flaws, including four for Stuxnet, in 2010.

In another indication that mobile is the next big target, Symantec counted 163 vulnerabilities, up from 115 in 2009. This near-40 percent jump included more Trojans on mobile platforms, Fosse says. But no major attacks on mobile platforms have occurred -- yet, he says. "In the next year or two, we're going to see [Trojans and other attacks] starting to emerge" with the increased use in enterprises of mobile devices, he says.

"Once there's a sufficient financial motive, [attackers] will focus more on mobile," he says.

Symantec also reported some interesting data, such as the price of a credit card in the black market, which is anywhere from 7 cents to $100; one botnet spotted by Symantec was selling 10,000 bots for $15. "Botnets are getting pretty cheap in the grand scheme of things," Fosse says.

And the average number of identities exposed per breach in 2010 was 260,000.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24259
PUBLISHED: 2021-05-05
The “Elementor Addon Elements� WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24260
PUBLISHED: 2021-05-05
The “Livemesh Addons for Elementor� WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24261
PUBLISHED: 2021-05-05
The “HT Mega – Absolute Addons for Elementor Page Builder� WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by ...
CVE-2021-24262
PUBLISHED: 2021-05-05
The “WooLentor – WooCommerce Elementor Addons + Builder� WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-priv...
CVE-2021-24263
PUBLISHED: 2021-05-05
The “Elementor Addons – PowerPack Addons for Elementor� WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scriptin...