F-Secure Deems 2012 the Year of the Exploit Kit
Promoting safer and more responsible use of online technology and mobile phones is essential on Safer Internet Day. Strong passwords are important but, as detailed in F-Secure’s latest Threat Report, a commoditized and professional malware industry brings its own challenges.
Business is booming for exploits, mobile malware is still dominated by Android and Symbian, and botnets are back and retooled, according to the new Threat Report H2 2012 from F-Secure Labs. Released in conjunction with Safer Internet Day, the report also provides tips for managing the cumbersome yet necessary problem of passwords.
“The world of malware today is commoditized and professionalized,” says Mikko Hypponen, Chief Research Officer at F-Secure. “We saw this especially in the second half of last year in the form of more standardization of vulnerability exploitation and the increased use of automated exploit kits.”
Exploit kits and old software vulnerabilities
2012 saw the exploitation of software vulnerabilities become the most popular way to gain access to a user’s machine. In the second half of the year, exploit-related detections accounted for 28 percent of all detections, with 68 percent of those related to vulnerabilities in Java.
The majority of exploits detected were related to four vulnerabilities (two Windows and two Java), most likely a result of the fact that today’s popular exploit kits, BlackHole and Cool Exploit, include exploits for these vulnerabilities. All of these vulnerabilities were reported in the last two years and have already had security patches released by their vendors – a reminder of the importance of keeping software updated.
“Criminals in the malware system each handle their own little niches, their own little links in the chain,” says Sean Sullivan, Security Advisor at F-Secure. “And exploits are the first link. They’re how the criminals get in the door.”
Mobile malware in numbers: Samples, or families and variants?
Android malware accounted for 79 percent (238) of all new, unique mobile malware variants in 2012, a number that speaks to the platform’s domination of the mobile market. Symbian took up the next largest share, with 19 percent of detected variants.
2012 witnessed security vendors exclaiming about the growth of Android malware samples, from tens to hundreds of thousands, depending on the report. While sample count has increased, F-Secure Labs resists focusing merely on them, “as samples just represent the outer layer of the malware package,” says Sullivan.
“On the inside it’s still the same malware family, but there can be a myriad of different ways to dress it up to try to disguise it. We instead prefer to focus on the number of families and variants.” Sullivan points out that growth in malware samples is evidence of commoditization and automation on the production side, not necessarily of more malware families in the wild.
“At F-Secure, we have a more holistic understanding of the security landscape, that it cannot be dependent on merely one data point,” says Sullivan. “To base a security analysis on a single data point is either foolish, or marketing hype.”
Botnets, banking trojans and the problem of passwords
Botnets, which had been handicapped in recent years by efforts from players in various affected fields, resurfaced in 2012 with new packaging and different methods. New business models like “rent-a-botnet” schemes are flourishing, where cybercriminals rent a whole network of infected computers and use it to perform their attacks. ZeroAccess, the fastest growing botnet, infected millions of computers globally in 2012, with up to 140,000 unique IPs in the US and Europe. Botnet Zeus, which is also a banking trojan, continues to reign, with the United States, Italy and Germany as the most affected countries.
The password, as the report says “is dead and we all know it.” Strong enough passwords are often too cumbersome to remember, and complicating matters, a separate password should be used for each account. Even strong passwords can be reset with the right social engineering tactics. But until a better solution comes along, the report offers tips for safe password management.
For more details on the latest trends in threats, including Mac malware, corporate espionage, and malware hosted on the Web, see F-Secure’s Threat Report H2 2012.
More information, F-Secure’s Threat Report H2 2012: http://www.f-secure.com/en/web/labs_global/whitepapers/reports
How do I remember strong passwords?
Threat report H2 2012 Safe and Savvy blog post:
F-Secure – Protecting the irreplaceable
While you concentrate on what is important to you, we make sure you are protected and safe online whether you are using a computer or a smartphone. We also backup and enable you to share your important files. Our services are available through over 200 operators around the world and trusted in millions of homes and businesses. Founded in 1988, F-Secure is listed on NASDAQ OMX Helsinki Ltd.
f-secure.com | twitter.com/fsecure | facebook.com/f-secure
For more information, please contact
Anna Vuori-Karvia, Media Contact
Tel. +358 (0)40 159 9636