Zero-Day Discoveries A Once-A-Week Habit

A new zero-day vulnerability was discovered every week in 2015, with attackers increasingly homing their crosshairs on Adobe Flash, according to the latest Internet Security Threat Report (ISTR) released today by security researchers at Symantec.

The report took a broad-based look at the biggest trends in cyberattack techniques and breach trends in the last year, with some startling vulnerability statistics bubbling up in the findings. Chief among them that new zero-day vulnerability discoveries jumped by 125% in 2015, even as the total number of new vulnerabilities reported and patched actually decreased by 15% compared to 2014.  

The sharp rise in zero days showed how economic incentives are shaping vulnerability-hunting and exploit for the bad guys.

"Given the value of these vulnerabilities, it’s not surprising that a market has evolved to meet demand," the ISTR said. "Targeted attack groups exploit the vulnerabilities until they are publicly exposed, then toss them aside for newly discovered vulnerabilities."

The report found that four of the top five most exploited zero-day vulnerabilities were those found in Adobe Flash, which Symantec researchers pegged as being software whose days are numbered due to security woes.

"From a security perspective, we expect Adobe Flash will gradually fall out of common usage over the next year," the report said.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Many of these targeted zero-day attacks are delivered by way of spearphishing campaigns, which Symantec reports increased by 55% last year. According to the firm, large companies subjected to targeted spear-phishing campaigns see an average of 3.6 successful attacks per campaign. Though targeted spearphishing attacks are distributed across all sectors and business sizes, the largest distribution appears to be among finance, insurance, and real estate firm. Meanwhile, those firms with over 2,500 employees were at higher risk of being targeted.

In addition to spearphishing, targeted attackers also continue to lean heavily on watering-hole attacks that exploit compromised websites to deliver malware to unsuspecting visitors.

"Sophisticated watering-hole attacks, using compromised websites, activate only when a visitor to that website originates from a particular IP address," the report explained. "Reducing collateral damage in this way makes it less likely that the covert attack is discovered. Moreover, this approach also makes it more difficult for security researchers who may visit the website from a different location."

Watering-hole attacks are made easy to execute given the number of holes found within the average web property today. According to Symantec, 78% of websites today suffer from vulnerabilities, with one in seven of those being critical vulnerabilities that allow malicious code to be run without any user interaction. These are numbers that Symantec has said have held pretty steady over the last few years, suggesting that website owners are not making progress on the problem.

Related Content: