Language Selection

English French German Italian Portuguese Spanish

Drive-by Trojans exploit browser flaws

Filed under
Security

Trojans - malicious programs that pose as benign apps - are usurping network worms to become the greatest malware menace. Sixteen of the 50 most frequent malicious code sightings reported to Symantec in the second half of 2004 were Trojans. In the first six months of last year, Trojans accounted for just eight of the top 50 malicious code reports.

Symantec blames Trojans for an upsurge in client-side exploits for web browsers. Trojans create the means to deliver malicious code onto vulnerable Windows PCs. Browsers are the primary target, but flaws in email clients, peer-to-peer networks, instant messaging clients, and media players can also be exploited in this way.

Between July and December 2004 Symantec documented 13 vulnerabilities affecting Internet Explorer and 21 vulnerabilities affecting each of the Mozilla browsers. Six vulnerabilities were reported in Opera and none in Safari.

Of the 13 vulns affecting IE in 2H04, nine were classified as "high severity". Of the 21 vulnerabilities affecting the Mozilla browsers, Symantec classified 11 as "high severity". Firefox users enjoyed an easier ride with just seven affecting "high severity" vulns over the report period.

Symantec says there have been few attacks in the wild against Mozilla, Mozilla Firefox, Opera, or Safari, but the jury is still out on whether these browsers represent a more secure alternative to IE.

Nigel Beighton, Symantec’s director of enterprise strategy, EMEA, told El Reg that choice of browser is less important than activating seldom-used security zones features to limit exposure. "If you don't set trusted sites and stick by default browser security it's like surfing everywhere on the net with your wallet open," he said.

Symantec's Internet Threat Report, published Monday (21 March), brings together data gleaned from the security firm's SecurityFocus and managed security services division. The report found that financial service industry was the most frequently targeted sector in internet attacks, followed by hi-tech and pharmaceutical firms. "Attacks are becoming more targeted and specific," said Beighton.

For the third straight reporting period, the Microsoft SQL Server Resolution Service Stack Overflow Attack (formerly referred to as the Slammer Attack) was the most common attack, used by 22 per cent of all attackers. Organisations reported 13.6 attacks per day, up from 10.6 in the previous six months. The United States continues to be the top country of attack origin, followed by China and Germany.

Variants of NetSky, MyDoom, and Beagle, dominated the top ten malicious code samples in the second half of 2004. Symantec documented more than 7,360 new Win32 viruses and worms, 64 per cent up on the first half of the year. Two bots (malicious code that turns infected PCs into zombies under the command of hackers) were present in the top ten malicious code samples, compared to one in the previous reporting period. There were 21 known samples of malicious code for mobile applications, up from one in June 2004.

Symantec also noted a marked rise in email scams over second half of 2004. The firm's BrightMail anti-spam filters blocked an average of 33 million phishing emails a week in December 2004 compared to nine million a week in July 2004.
Symantec documented 1,403 new vulnerabilities in the second half of 2003, up 13 per cent from the first six months of last year. The vast majority (97 per cent) of the vulns recorded between July and December 2004 were either moderate or high risk.

In addition, over 70 per cent of these security flaws could be exploited using readily available tools or without the need for any attack code. The time between the disclosure of a vulnerability and the release of an associated exploit increased from 5.8 to 6.4 days.

Continuing a recent trend, web applications were a particular source of security problems. Almost half - 670 of 1,403 - of the security bugs logged by Symantec in 2H04 affected web applications. ®

Source.

More in Tux Machines

Comparison of the Samsung Z1 vs Z2 vs Z3 Tizen smartphones

Compare Samsung Z1, Z2, and Z3 Tizen Smartphones Lets do a quick history lesson: The first Tizen Smartphone was the Samsung Z1, then came the Z3, and yesterday was the turn of the 4G touting Z2 to take centre stage. On the whole the Z2 is very similar to the Z1 and can be thought of a Z1 2016 edition with the inclusion of 4G cellular connectivity and updated software with user requested features. Read more

25 things to love about Linux

Today marks 25 years of Linux, the most successful software ever. At LinuxCon this week, Jim Zemlin of the Linux Foundation spoke words of admiration, praise, and excitement from the keynote stage, saying "Linux at 25 is a big thing" and "You can better yourself while bettering others at the same time." To celebrate, we asked our readers what they love about Linux and rounded up 25 of their responses. Dive into the Linux love! Read more

GNU/FSF

Linux and Graphics

  • ContainerCon Vendors Offer Flexible Solutions for Managing All Your New Micro-VMs
    As you might expect, this week's LinuxCon and ContainerCon 2016, held in Toronto, is heavy on the benefits and pitfalls of deploying containers, but several vendors aim to come to the rescue with flexible tools to manage it all. Take Datadog, a New York-based company that offers scalable monitoring of your containerized infrastructure—and just about everything else—from a single interface. This is an off-premise, cloud-based tool that can monitor tens of thousands of your hosts and integrate with stuff you already know, like AWS, Cassandra, Docker, Kubernetes, Postgre and 150 other tools.
  • Happy Birthday Linux
    Linux turns 25 today. That's four years older than Linus was when he invented it. That means Linus has spent more of his life with Linux than he did without it
  • AMDGPU In Linux 4.9 To Bring Virtual Display Support, Improved GPU Reset
    The first pull request has been submitted of new Radeon and AMDGPU DRM driver updates to be queued in DRM-Next for landing with the Linux 4.9 kernel. To look forward to Linux 4.9 even though Linux 4.8 is still weeks from being released is PowerPlay support for Iceland GPUs, improved GPU reset, UVD and VCE power-gating for Carrizo and Stoney, support for pre-initialized vRAM buffers, TTM clean-ups, virtual display support, and other low-level changes. Many bug fixes also present. The AMDGPU virtual display support is useful and we have been looking forward to it. GPU reset improvements are also welcome for better recovery when the GPU becomes hung. As is the case lately, most of these changes are focused around the newer AMDGPU DRM driver over the mature Radeon DRM code.
  • OpenGL ES 3.1 Comes For Intel Haswell On Mesa
    For those running Intel Haswell processors, hope is not lost in seeing new versions of OpenGL extensions with the Intel Mesa driver.