Language Selection

English French German Italian Portuguese Spanish

Drive-by Trojans exploit browser flaws

Filed under
Security

Trojans - malicious programs that pose as benign apps - are usurping network worms to become the greatest malware menace. Sixteen of the 50 most frequent malicious code sightings reported to Symantec in the second half of 2004 were Trojans. In the first six months of last year, Trojans accounted for just eight of the top 50 malicious code reports.

Symantec blames Trojans for an upsurge in client-side exploits for web browsers. Trojans create the means to deliver malicious code onto vulnerable Windows PCs. Browsers are the primary target, but flaws in email clients, peer-to-peer networks, instant messaging clients, and media players can also be exploited in this way.

Between July and December 2004 Symantec documented 13 vulnerabilities affecting Internet Explorer and 21 vulnerabilities affecting each of the Mozilla browsers. Six vulnerabilities were reported in Opera and none in Safari.

Of the 13 vulns affecting IE in 2H04, nine were classified as "high severity". Of the 21 vulnerabilities affecting the Mozilla browsers, Symantec classified 11 as "high severity". Firefox users enjoyed an easier ride with just seven affecting "high severity" vulns over the report period.

Symantec says there have been few attacks in the wild against Mozilla, Mozilla Firefox, Opera, or Safari, but the jury is still out on whether these browsers represent a more secure alternative to IE.

Nigel Beighton, Symantec’s director of enterprise strategy, EMEA, told El Reg that choice of browser is less important than activating seldom-used security zones features to limit exposure. "If you don't set trusted sites and stick by default browser security it's like surfing everywhere on the net with your wallet open," he said.

Symantec's Internet Threat Report, published Monday (21 March), brings together data gleaned from the security firm's SecurityFocus and managed security services division. The report found that financial service industry was the most frequently targeted sector in internet attacks, followed by hi-tech and pharmaceutical firms. "Attacks are becoming more targeted and specific," said Beighton.

For the third straight reporting period, the Microsoft SQL Server Resolution Service Stack Overflow Attack (formerly referred to as the Slammer Attack) was the most common attack, used by 22 per cent of all attackers. Organisations reported 13.6 attacks per day, up from 10.6 in the previous six months. The United States continues to be the top country of attack origin, followed by China and Germany.

Variants of NetSky, MyDoom, and Beagle, dominated the top ten malicious code samples in the second half of 2004. Symantec documented more than 7,360 new Win32 viruses and worms, 64 per cent up on the first half of the year. Two bots (malicious code that turns infected PCs into zombies under the command of hackers) were present in the top ten malicious code samples, compared to one in the previous reporting period. There were 21 known samples of malicious code for mobile applications, up from one in June 2004.

Symantec also noted a marked rise in email scams over second half of 2004. The firm's BrightMail anti-spam filters blocked an average of 33 million phishing emails a week in December 2004 compared to nine million a week in July 2004.
Symantec documented 1,403 new vulnerabilities in the second half of 2003, up 13 per cent from the first six months of last year. The vast majority (97 per cent) of the vulns recorded between July and December 2004 were either moderate or high risk.

In addition, over 70 per cent of these security flaws could be exploited using readily available tools or without the need for any attack code. The time between the disclosure of a vulnerability and the release of an associated exploit increased from 5.8 to 6.4 days.

Continuing a recent trend, web applications were a particular source of security problems. Almost half - 670 of 1,403 - of the security bugs logged by Symantec in 2H04 affected web applications. ®

Source.

More in Tux Machines

Open source docks with mainstream vendors

Open source and mainstream are joining forces this week as the Docker software containerisation platform comes under the spotlight at technology-focused network and information sessions in Cape Town and Johannesburg. "The diversity of our partners at the event − Docker, Microsoft Azure, Atlassian, SUSE and HPE – is a clear indication of the excitement around the Docker platform," says Muggie van Staden, MD of Obsidian Systems. Read more

What’s the best Linux firewall distro of 2017?

You don’t have to manage a large corporate network to use a dedicated firewall. While your Linux distro will have an impressive firewall – and an equally impressive arsenal of tools to manage it – the advantages don’t extend to the other devices on your network. A typical network has more devices connected to the internet than the total number of computers and laptops in your SOHO. With the onslaught of IoT, it won’t be long before your router doles out IP addresses to your washing machine and microwave as well. The one thing you wouldn’t want in this Jetsonian future is having to rely on your router’s limited firewall capabilities to shield your house – and everyone in it – from the malicious bits and bytes floating about on the internet. A dedicated firewall stands between the internet and internal network, sanitising the traffic flowing into the latter. Setting one up is an involved process both in terms of assembling the hardware and configuring the software. However, there are quite a few distros that help you set up a dedicated firewall with ease, and we’re going to look at the ones that have the best protective open source software and roll them into a convenient and easy to use package. Read more

Zorin OS 12 Business Edition Launches with macOS, Unity, and GNOME 2 Layouts

Three months after launching the biggest release ever of the Ubuntu-based operating system, the Zorin OS team is today announcing the availability of Zorin OS 12 Business Edition. Based on Ubuntu 16.04 LTS (Xenial Xerus) and powered by the long-term supported Linux 4.4 kernel, Zorin OS 12 Business Edition ships with the innovative Zorin Desktop 2.0 desktop environment that offers multiple layouts for all tastes. These means that you can make your Zorin OS 12 desktop look like macOS, GNOME 2, or Unity with a click. Read more

GNOME and Other Software

  • Nautilus 3.24 – The changes
    Since Nautilus was created, if a user wanted to open a folder where the user didn’t have permissions, for example a system folder where only root has access, it was required to start Nautilus with sudo. However running UI apps under root is strongly discouraged, and to be honest, quite inconvenient. Running any UI app with sudo is actually not even supported in Wayland by design due to the security issues that that conveys.
  • GNOME hackaton in Brno
    Last week, we had a presentation on Google Summer of Code and Outreachy at Brno University of Technology. Around 80 students attended which was a pretty good success considering it was not part of any course. It was a surprise for the uni people as well because the room they booked was only for 60 ppl.
  • Peek Gif Recorder Gets Updated, Now Available from a PPA
    Peek, the nifty animated gif screen capture app for Linux desktops, has been updated. Peek 0.9 reduces the size of temporary files, adds a resolution downsampling option (to help the app use fewer resources when rendering your gif), and introduces fallback support for avconf should ffmpeg be unavailable.
  • Cerebro is an Open Source OS X Spotlight Equivalent for Linux
    Billed as an ‘open-source productivity booster with a brain’, Cerebro is an Electron app able to run across multiple platforms. It’s an extendable, open-source alternative to Spotlight and Alfred on macOS, and Synapse, Kupfer, Ulauncher, GNOME Do, and others on Linux.
  • JBoss Fuse 6.3 integration services for Red Hat OpenShift released
    Red Hat announced the latest update to the Red Hat JBoss Fuse-based integration service on Red Hat OpenShift. With the growth of the Internet of Things (IoT), cloud-based SaaS systems, and new data streams, organizations can face increasing pressure to more quickly deliver innovative new services. Traditional centralized, monolithic ESB-style integration approaches are often ill-suited to support the business in responding to this pressure.
  • Fedora 25: The perf linux tool.
  • Meet the chap open-sourcing US govt code – Paul, an ex-Microsoft anti-piracy engineer [Ed: Used to work for Microsoft and now spreads the GPL ("cancer" according to Microsoft) in the US government]
    The manager of the project, Berg said, really wanted to release MOOSE as open source, but didn't know how to do so. As a result it took 18 months to traverse government bureaucracy and to obtain the necessary permissions. It's now available under the GPL 2.1 license.