Language Selection

English French German Italian Portuguese Spanish

Drive-by Trojans exploit browser flaws

Filed under
Security

Trojans - malicious programs that pose as benign apps - are usurping network worms to become the greatest malware menace. Sixteen of the 50 most frequent malicious code sightings reported to Symantec in the second half of 2004 were Trojans. In the first six months of last year, Trojans accounted for just eight of the top 50 malicious code reports.

Symantec blames Trojans for an upsurge in client-side exploits for web browsers. Trojans create the means to deliver malicious code onto vulnerable Windows PCs. Browsers are the primary target, but flaws in email clients, peer-to-peer networks, instant messaging clients, and media players can also be exploited in this way.

Between July and December 2004 Symantec documented 13 vulnerabilities affecting Internet Explorer and 21 vulnerabilities affecting each of the Mozilla browsers. Six vulnerabilities were reported in Opera and none in Safari.

Of the 13 vulns affecting IE in 2H04, nine were classified as "high severity". Of the 21 vulnerabilities affecting the Mozilla browsers, Symantec classified 11 as "high severity". Firefox users enjoyed an easier ride with just seven affecting "high severity" vulns over the report period.

Symantec says there have been few attacks in the wild against Mozilla, Mozilla Firefox, Opera, or Safari, but the jury is still out on whether these browsers represent a more secure alternative to IE.

Nigel Beighton, Symantec’s director of enterprise strategy, EMEA, told El Reg that choice of browser is less important than activating seldom-used security zones features to limit exposure. "If you don't set trusted sites and stick by default browser security it's like surfing everywhere on the net with your wallet open," he said.

Symantec's Internet Threat Report, published Monday (21 March), brings together data gleaned from the security firm's SecurityFocus and managed security services division. The report found that financial service industry was the most frequently targeted sector in internet attacks, followed by hi-tech and pharmaceutical firms. "Attacks are becoming more targeted and specific," said Beighton.

For the third straight reporting period, the Microsoft SQL Server Resolution Service Stack Overflow Attack (formerly referred to as the Slammer Attack) was the most common attack, used by 22 per cent of all attackers. Organisations reported 13.6 attacks per day, up from 10.6 in the previous six months. The United States continues to be the top country of attack origin, followed by China and Germany.

Variants of NetSky, MyDoom, and Beagle, dominated the top ten malicious code samples in the second half of 2004. Symantec documented more than 7,360 new Win32 viruses and worms, 64 per cent up on the first half of the year. Two bots (malicious code that turns infected PCs into zombies under the command of hackers) were present in the top ten malicious code samples, compared to one in the previous reporting period. There were 21 known samples of malicious code for mobile applications, up from one in June 2004.

Symantec also noted a marked rise in email scams over second half of 2004. The firm's BrightMail anti-spam filters blocked an average of 33 million phishing emails a week in December 2004 compared to nine million a week in July 2004.
Symantec documented 1,403 new vulnerabilities in the second half of 2003, up 13 per cent from the first six months of last year. The vast majority (97 per cent) of the vulns recorded between July and December 2004 were either moderate or high risk.

In addition, over 70 per cent of these security flaws could be exploited using readily available tools or without the need for any attack code. The time between the disclosure of a vulnerability and the release of an associated exploit increased from 5.8 to 6.4 days.

Continuing a recent trend, web applications were a particular source of security problems. Almost half - 670 of 1,403 - of the security bugs logged by Symantec in 2H04 affected web applications. ®

Source.

More in Tux Machines

Your Beard Doesn’t Intimidate Me Anymore!

Linux is a community environment. Whether it’s the professionals over at RedHat, Canonical, and Suse or the guys who got together and decided to create Hannah Montana Linux, behind every project there’s usually a community. My first attempt at Linux came in the desert in Iraq. We were building a router lab and I had a couple of blade servers lying around but couldn’t get the Microsoft 2003 server key from our IT guys. So the other resident nerd on site and I started downloading Linux Distros to check them out. OpenSuse was awesome, Ubuntu was in its infancy, and I had no idea what I was doing. At night I’d trudge through forum after forum trying to figure out how the OS could help solve the problems I was creating and experiencing. There were a lot of posts for post-windows users and not all of them were kind. Many of them were written with a rather mocking or haughty tone. There was almost a standard litmus tests on posts where the person would casually mention how long they’ve been running Linux. Anything less than five years was a noob and others on the forum would point it out. There were a lot of good, kind voices, but they were often drowned out by those with a chip on their shoulder. (Read the rest)

Red Hat News

  • Red Hat Data Science talks at Apache Big Data 2016
    Unfortunately, my talk is at the same time as Suneel’s, so I won’t be able to attend his, but these are all great talks and you should be sure to put as many as possible on your schedule if you’ll be in Vancouver!
  • Red Hat Platform Selected As Reference Platform For Telefonica Operators
    Red Hat, Inc. (RHT) and Telefonica Business Solutions, a provider of a wide range of integrated communication solutions for the B2B market, announced an agreement establishing Red Hat Mobile Application Platform as the global reference platform for operators within the Telefonica Group to mobilize the business processes of its customers on their path to digital transformation.
  • Telefonica and Red Hat Sign a Global Agreement to Help Companies Mobilize Business Processes
    Red Hat, Inc. (NYSE: RHT), the world's leading provider of open source solutions, and Telefonica Business Solutions, a leading provider of a wide range of integrated communication solutions for the B2B market, today announced an agreement establishing Red Hat Mobile Application Platform as the global reference platform for operators within the Telefonica Group to mobilize the business processes of its customers on their path to digital transformation.
  • Fedora “update testing” with Bodhi
    Before and after Fedora releases, there are updates that keep coming in to fix bugs or add minor features to packages included in Fedora. To ensure that these are stable and don’t affect the performance of the existing system, we do “update testing”. Once testing is complete, we share our results and make sure that the developer is aware about the bugs and the success rate of the package. This article will explain how to participate in update testing and contribute to a high quality Fedora release!

Android Leftovers

This Is How the New Linux Mint 18 Cinnamon Theme Looks Like

Linux Mint project leader and maintainer Clement Lefebvre dropped some exciting news today about what users should expect from the upcoming Linux Mint 18 "Sarah" operating system. Read more