Zero-Day Discoveries A Once-A-Week Habit

Symantec threat report shows growth in zero-day vulns to enable more targeted attacks.

A new zero-day vulnerability was discovered every week in 2015, with attackers increasingly homing their crosshairs on Adobe Flash, according to the latest
Internet Security Threat Report (ISTR)
released today by security researchers at Symantec.
The report took a broad-based look at the biggest trends in cyberattack techniques and breach trends in the last year, with some startling vulnerability statistics bubbling up in the findings. Chief among them that new zero-day vulnerability discoveries jumped by 125% in 2015, even as the total number of new vulnerabilities reported and patched actually decreased by 15% compared to 2014.
The sharp rise in zero days showed how economic incentives are shaping vulnerability-hunting and exploit for the bad guys.
Given the value of these vulnerabilities, it’s not surprising that a market has evolved to meet demand, the ISTR said. Targeted attack groups exploit the vulnerabilities until they are publicly exposed, then toss them aside for newly discovered vulnerabilities.
The report found that four of the top five most exploited zero-day vulnerabilities were those found in Adobe Flash, which Symantec researchers pegged as being software whose days are numbered due to security woes.
From a security perspective, we expect Adobe Flash will gradually fall out of common usage over the next year, the report said.
Gain insight into the latest threats and emerging best practices for managing them. Attend the
Security Track
at Interop Las Vegas, May 2-6.
Register now
!
Many of these targeted zero-day attacks are delivered by way of spearphishing campaigns, which Symantec reports increased by 55% last year. According to the firm, large companies subjected to targeted spear-phishing campaigns see an average of 3.6 successful attacks per campaign. Though targeted spearphishing attacks are distributed across all sectors and business sizes, the largest distribution appears to be among finance, insurance, and real estate firm. Meanwhile, those firms with over 2,500 employees were at higher risk of being targeted.
In addition to spearphishing, targeted attackers also continue to lean heavily on watering-hole attacks that exploit compromised websites to deliver malware to unsuspecting visitors.
Sophisticated watering-hole attacks, using compromised websites, activate only when a visitor to that website originates from a particular IP address, the report explained. Reducing collateral damage in this way makes it less likely that the covert attack is discovered. Moreover, this approach also makes it more difficult for security researchers who may visit the website from a different location.
Watering-hole attacks are made easy to execute given the number of holes found within the average web property today. According to Symantec, 78% of websites today suffer from vulnerabilities, with one in seven of those being critical vulnerabilities that allow malicious code to be run without any user interaction. These are numbers that Symantec has said have held pretty steady over the last few years, suggesting that website owners are not making progress on the problem.
Related Content:
Biggest Trends Bubbling Up For Interop
Symantec: Financial Trojans Declined By 73% In 2015
Vuln Disclosure: Why Security Vendors & Researchers Don’t Trust Each Oth
er

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Zero-Day Discoveries A Once-A-Week Habit