Join our community and be part of the conversation.
To subscribe, simply enter your email address on our website or click the subscribe button below. Don't worry, we respect your privacy and won't spam your inbox. Your information is safe with us.
For years, the focus of security attacks have been on the Windows platform. However, things started to change since 2012 where attacks on mobile platforms became more popular.One good example is Opfake, which covers a wide range of device OSes, from Symbian, to Windows Mobile, to Android, and even iOS devices.
Attacks upon the Apple platform also gained breakthrough this year; the Flashback trojan which first appeared last year, had a breakout performance in April, successfully infecting approximately 600,000 Macs.
W32.Flammer – The most complex malware ever detected
W32.Flamer was first discovered when the Iranian Oil Ministry was attacked. As a result, the ministry decided to disconnect its facilities from the Internet.
Based on what Symantec found, this trojan’s core purpose is to gather data from compromised computers. Period.
Symantec claims to have no knowledge on who made the Flammer and it recognises that it is the most complex piece of malware, ever.
What is interesting about Flamer is that it appears to have been developed by professional software developers. The code is very clean, and it has an advanced architectural design. For instance, it makes use of a highly customisable scripting language called Lua, which allows the attackers to create custom modules for the threat. It also contains a SQLite database which it uses to collect and store information.
Figure 1: Comparing Flammer with Stuxnet and Dugu
Android.Opfake makes another run
Android.Opfake is malware written for Android devices that masquerades as various apps and content, including even as an installer for the Opera Web browser and a pornographic movie, which requires the user to pay for them. It demands payment for the app or content through Short Message Service (SMS) messages.
Symantec found that it is being distributed as disguises for games such as Temple Run and Cut the Rope. The attackers have even gone so far as to include images of actual devices playing the games in an attempt to convince unsuspecting users that the malicious versions are actually legitimate.
Trojan.Neloweg
This trojan is primarily targeting the UK and the Netherlands. It is a banking trojan which attempts to steal banking credentials. This is carried out by detecting which banking sites the user is currently browsing and if a match is found, it will cover part of the page in white, using a hidden DIV tag, and execute custom JavaScript located on the malicious server.
Affected browsers are Firefox and Internet Explorer which makes up 50-percent of the share.
Global threats analysis report
Summary:
Spam – 67.8 percent (an increase of 3.3 percentage points since April):
Phishing – One in 568.3 emails identified as phishing (a decrease of 0.03 percentage points since April):
Malware – One in 365.1 emails contained malware (an increase of 0.03 percentage points since April):
Malicious Web sites – 4,359 Web sites blocked per day (an increase of 48.7 percent since April):
Spam analysis
In May, the global ratio of spam in email traffic rose by 3.3 percentage points since April, to 67.8 percent (1 in 1.48 emails). This represents the first increase in spam levels since the end of 2011.
Saudi Arabia remained the most spammed geography in May; with a spam rate of 77- percent.
The most common category of spam in May related to the Adult/Sex/Dating category, down slightly from April, but still making up the vast majority of spam for the month.
The proportion of spam that contained a malicious attachment or link increased toward the end of the previous month. Many of these larger attachments were related to generic polymorphic malware variants such as Bredolab.
As of result of this, the number of bounced emails known as NDRs also increased between April and May 2012.
Phishing analysis
In May, the global phishing rate decreased by 0.03 percentage points, taking the global average rate to one in 568.3 emails (0.18 percent) that comprised some form of phishing attack.
The Netherlands remained the country most targeted for phishing attacks in May, with one in 196.2 emails identified as phishing.
Phishing web sites are most often created by automated toolkits which consists of 65.9-percent. Other tactics include unique domains (27.4-percent), IP Address Domains (2.5-percent), Free Web Hosting Sites (3.3-percent) and Typosquatting (1-percent).
Malware analysis
The global ratio of email-borne viruses in email traffic was one in 365.1 emails (0.27 percent) in May, a decrease of 0.03 percentage points since April.
In May, 26.2 percent of email-borne malware contained links to malicious Web sites, 16.9 percentage points higher than the previous month.
Luxembourg was the geography with the highest ratio of malicious email activity in May, with one in 167.2 emails identified as malicious.
Malware attacks consist of a few core types:
1.) Malicious email-borne attacks
Malicious email-borne attacks destined for small to medium-sized businesses (1-250) accounted for one in 365.7 emails, compared with one in 352.6 for large enterprises (2500+).
2.) Web-based malware threats
This is referring to Web sites which carry malware propogation either deliberately or not.
3.) Endpoint security threats
This is referring to propagation of attacks via USB storage devices and insecure network connections.
Symantec sensors
Symantec has established some of the most comprehensive sources of Internet threat data in the world through the Symantec Global Intelligence Network, which is made up of more than 64.6 million attack sensors and records thousands of events per second.This network monitors attack activity in more than 200 countries and territories through a combination of Symantec products and services such as Symantec DeepSight Threat Management System, Symantec Managed Security Services and Norton consumer products, and other third-party data sources.
In addition, Symantec maintains one of the world’s most comprehensive vulnerability databases, currently consisting of more than 47,662 recorded vulnerabilities (spanning more than two decades) from over 15,967 vendors representing over 40,006 products.
Spam, phishing and malware data is captured through a variety of sources, including the Symantec Probe Network, a system of more than 5 million decoy accounts; Symantec.cloud and a number of other Symantec security technologies. Skeptic, the Symantec.cloud proprietary heuristic technology is able to detect new and sophisticated targeted threats before reaching customers’ networks. Over 8 billion email messages and more than 1.4 billion Web requests are processed each day across 15 data centres. Symantec also gathers phishing information through an extensive antifraud community of enterprises, security vendors, and more than 50 million consumers.
These resources give Symantec’s analysts unparalleled sources of data with which to identify, analyse, and provide informed commentary on emerging trends in attacks, malicious code activity, phishing, and spam. The result is the annual Symantec Internet Security Threat Report.
