McAfee today released the McAfee Threats
Report: Fourth Quarter 2012, (report)
in which McAfee Labs revealed that sophisticated attacks originally
targeting the financial services industry are now increasingly directed
at other critical sectors of the economy, while an emerging set of new
tactics and technologies are being implemented to evade
industry-standard security measures. The report showed the continued
proliferation of password-stealing trojans and advanced persistent
threats (APTs) such as Operation High Roller and Project Bliztkrieg, and
the expansion of their attacks to government, manufacturing and
commercial transaction infrastructure targets.
“We are seeing attacks shifting into a variety of new areas, from
factories, to corporations, to government agencies, to the
infrastructure that connects them together,” said Vincent Weafer, senior
vice president of McAfee Labs. “This represents a new chapter in
cybersecurity in that threat-development, driven by the lure of
financial industry profits, has created a growing underground market for
these cybercrime weapons, as well as creative new approaches to
thwarting security measures common across industries.”
Leveraging data from McAfee’s Global Threat Intelligence (GTI) network,
the McAfee Labs team of 500 multidisciplinary researchers in 30
countries follows the complete range of threats in real time,
identifying application vulnerabilities, analyzing and correlating
risks, and enabling instant remediation to protect enterprises and the
public. In Q4 2012, McAfee Labs identified the following trends:
More Threats, More Availability, More Industries Targeted
As a group, unique password-stealing trojans grew 72 percent in Q4 as
cybercriminals realized that user authentication credentials constitute
some of the most valuable intellectual property stored on most
computers. Now widely available, these trojans are increasingly
appearing within customized threats or combined with other
“off-the-shelf” threats available on the internet. Fourth quarter
revelations around the Citadel trojan suggest that this trojan’s
information theft capabilities are being deployed beyond the financial
services sector.
Web Threats Shift from Botnets to URLs
McAfee continued to see suspicious URLs replacing botnets as the primary
distribution mechanism for malware. An analysis of web threats found
that the number of new suspicious URLs increased by 70 percent in Q4.
New suspect URLs averaged 4.6 million per month, almost doubling the
previous 2.7 million per month figure from the last two quarters.
Ninety-five percent of these URLs were found to be hosting malware,
exploits or code designed specifically to compromise computers. The
decline in the number of infected systems controlled by botnet operators
is driven in part by law enforcement efforts to bring botnets down, but
perhaps more so by the declining appeal of the botnet business model.
Increase in Infections beneath the OS
The volume of Master Boot Record-related malware climbed 27 percent to
reach an all-time quarterly high. These threats embed themselves deep
within the PC system storage stack, where standard antivirus solutions
cannot detect them. Once embedded, they can steal user information,
download other malicious software, or leverage the infected PC’s
computing power to launch attacks against other PCs or networks. While
these MBR attacks represent a relatively small portion of the overall PC
malware landscape, McAfee Labs expects them to become a primary attack
vector in 2013.
Malicious Signed Binaries Circumvent System Security
The number of electronically-signed malware samples doubled over the
course of Q4. This clearly indicates that cybercriminals have decided
that signing malware binaries is one of the best ways to circumvent
standard system security measures.
Mobile Malware Continues to Increase and Evolve
The number of mobile malware samples discovered by McAfee Labs in 2012
was 44 times the number found in 2011, meaning 95 percent of all mobile
malware samples appeared in the last year alone. Cybercriminals are now
dedicating the majority of their efforts to attacking the mobile Android
platform, with an 85 percent jump of new Android-based malware samples
in Q4 alone. The motivation for deploying mobile threats is rooted in
the inherent value of the information found on mobile devices, including
passwords and address books, as well as new “business” opportunities
that are not available on the PC platform. These opportunities include
Trojans that send SMS messages to premium services, then charge the user
for each message sent. More information on mobile-specific malware can
also be found in the recently-released 2012 Consumer Mobile Trends
Report:
McAfee, a wholly owned subsidiary of Intel Corporation (NASDAQ:INTC),
empowers businesses, the public sector, and home users to safely
experience the benefits of the Internet. The company delivers proactive
and proven security solutions and services for systems, networks, and
mobile devices around the world. With its Security Connected strategy,
innovative approach to hardware-enhanced security, and unique Global
Threat Intelligence network, McAfee is relentlessly focused on keeping
its customers safe http://www.mcafee.com.
Note: McAfee is a trademark or registered trademark of McAfee, Inc.
in the United States and other countries. Other names and brands may be
claimed as the property of others.
web feeds
