Symantec Intelligence Report., January 2014

SYMANTEC INTELLIGENCE REPORT
JANUARY 2014
p. 2 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014
CONTENTS CONTENTS
3 Executive Summary 4 7 BIG NUMBERS TARGETED ATTACKS 19 SPAM, PHISHING, & MALWARE 20 Spam 20 Top 5 Activity for Spam Destination by Geography 20 Top 5 Activity for Spam Destination by Industry 21 Top 10 Sources of Spam 21 Average Spam Message Size 21 Top 5 Activity for Spam Destination by Company Size 21 Spam by Category 21 Spam URL Distribution Based on Top Level Domain Name 22 Phishing 22 Top 10 Sources of Phishing 22 Top 5 Activity for Phishing Destination by Company Size 22 Top 5 Activity for Phishing Destination by Industry 22 Top 5 Activity for Phishing Destination by Geography 23 Phishing Distribution 23 Organizations Spoofed in Phishing Attacks 24 Malware 24 Proportion of Email Traffic in Which Virus Was Detected 24 Top 10 Email Virus Sources 25 Top 5 Activity for Malware Destination by Industry 25 Top 5 Activity for Malware Destination by Geographic Location 25 Top 5 Activity for Malware Destination by Company Size 26 Endpoint Security 26 Top 10 Most Frequently Blocked Malware 27 Policy Based Filtering 27 Policy Based Filtering 28 About Symantec 28 More Information
8 Targeted Attacks 8 Targeted Attacks per Day 8 First Attacks Logged by Month 9 Attacks by Size of Targeted Organization 9 Top 10 Industries Attacked 9 First Attacks Logged by Size 9 File Extensions of Attachments 10 Social Media 11 Social Media 11 Top 5 Social Media Attacks 12 DATA BREACHES 13 Data Breaches 13 Top 5 Types of Information Exposed 13 Twelve-Month Timeline of Data Breaches 14 MOBILE 15 Mobile 15 Mobile Malware by Type 16 Cumulative Mobile Android Malware 17 VULNERABILITIES 18 Vulnerabilities 18 Total Vulnerabilities Disclosed by Month 18 Browser Vulnerabilities 18 Plug-in Vulnerabilities
Executive Summary
Welcome to the January edition of the Symantec Intelligence report. Symantec Intelligence aims to provide the latest analysis of cyber security threats, trends, and insights concerning malware, spam, and other potentially harmful business risks.
A number of large data breaches were reported during the month of January. The largest new data breach included the exposure of 105.8 million identities in South Korea. (Its worth noting that many individuals in the country had more than one account exposed in this breach.) Another large data breach, previously reported as including 40 million identities, has since had its numbers adjusted upwards and is now estimated at 110 million identities exposed. These two breaches contribute significantly in bringing the total number of identities exposed to over 500 million for the last twelve months. Targeted attacks are up to their highest level since August of last year, after what appears to be average-to-low attack numbers over the last four months. Manufacturing is the most targeted industry, making up 21.3 percent of attacks. The non-traditional services category, which includes hospitality, recreation, and repair, is a close second at 20.6 percent. The number of vulnerabilities reported is also up in January after lower numbers reported in November and December of last year. However, at 555 vulnerabilities, this number is still well below October, which reported a high of 663 for the month. In other news, spam and phishing rates are down slightly in January, while email virus rates are at their lowest levels since October of last year. We hope that you enjoy this months report and feel free to contact us with any comments or feedback. Ben Nahorney, Cyber Security Threat Analyst symantec_intelligence@symantec.com
BIG NUMBERS
Overall Email Phishing Rate:

HIGHER NUMBER = LOWER RISK
Estimated Global Email Spam Rate Per Day

SPAM AS PERCENT OF ALL EMAIL
Nov Dec Jan
1 in 1,311 1 in 1,053 1 in 1,444
100 90 80 70 60 50 40
62% 64% 62%
Overall Email Virus Rate:

HIGHER NUMBER = LOWER RISK
30 20 10 0
Nov
Dec
Jan
Nov Dec Jan
1 in 253 1 in 164 1 in 431
New Vulnerabilities
Nov Dec Jan
Mobile Vulnerabilities
Nov Dec Jan
6 1 2
438
471
555
Mobile Malware Variants

10000 9000
VARIANTS (CUMULATIVE)
8000 7000 6000 5000 4000 3000 2000 1000 0 J F M A M J J A S O N
7,751 186
132
139
Nov
Dec
Jan
Data Breaches
Number of Breaches (12 month period) Number of Identities Exposed (12 month period)
219
501,516,310
TARGETED ATTACKS
Targeted Attacks
At a Glance Targeted attacks were up in January, reaching their highest levels since August of 2013. Small companies of 250 employees or less were targeted in 39% of attacks, though organizations with 2500+ employees were targeted more often, based on first attacks. The .exe file type was the most common attachment, making up 24.7% of email-based targeted attacks that included file attachments.
Targeted Attacks per Day

Source: Symantec
250 225 200
TARGETED ATTACKS
175 150 125 100 75 50 25 JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC
2012
2013
2014
First Attacks Logged by Month

Source: Symantec
1200 1100 1000 900 800 700 600 500 400 300 200 100 F M A M J J A S O N D J 2014
Attacks by Size of Targeted Organization

Source: Symantec
First Attacks Logged by Size

Source: Symantec
Company Size
1-250 251-500 501-1000 1001-1500 1501-2500 2500+
Percent
38.9% 9.1% 5.8% 3.4% 4.8% 37.9%
Company Size
1-250 251-500 501-1000 1001-1500 1501-2500 2500+
Percent
29.2% 8.5% 9.6% 6.0% 7.5% 39.1%
Top 10 Industries Attacked

Source: Symantec
File Extensions of Attachments

Source: Symantec
Industry
Manufacturing Services - Non Traditional Finance, insurance & Real Estate Services - Professional Wholesale Transportation, communications, electric, gas & Sanitary Services Public Administration Retail Construction Mining
Percent
21.3% 20.6% 13.7% 11.4%
File Extension
.exe .doc .scr .au3 .jpg
Percent
24.7% 11.1% 8.4% 7.5% 6.2% 1.9% 1.5% 0.4% 0.4% 0.3%
11.0% 5.9% 4.2% 3.2% 2.2% 1.5%
.pdf .dat .com .rtf .zip
The Professional services category includes services such as Legal, Accounting, Health, and Education. Non-Traditional services include Hospitality, Recreational, and Repair services.
SOCIAL MEDIA
Social Media
At a Glance 82 percent of all social media attacks in January where fake offerings. Likejacking is the secondmost common type of social media attack at 8 percent.
Top 5 Social Media Attacks

Source: Symantec
Top 5 Social Media Attacks
82% 8% Likejacking 5% Manual Sharing 2% Fake Apps 2% Comment Jacking

Methodology
Fake Offering
Fake Offering. These scams invite social network users to join a fake event or group with incentives such as free gift cards. Joining often requires the user to share credentials with the attacker or send a text to a premium rate number. Fake Plug-in Scams. Users are tricked into downloading fake browser extensions on their machines. Rogue browser extensions can pose like legitimate extensions but when installed can steal sensitive information from the infected machine. Likejacking. Using fake Like buttons, attackers trick users into clicking website buttons that install malware and may post updates on a users newsfeed, spreading the attack. Fake Apps. Applications provided by attackers that appear to be legitimate apps; however, they contain a malicious payload. The attackers often take legitimate apps, bundle malware with them, and then re-release it as a free version of the app. Manual Sharing Scams. These rely on victims to actually do the hard work of sharing the scam by presenting them with intriguing videos, fake offers or messages that they share with their friends.
DATA BREACHES
Data Breaches
At a Glance The largest data breach that was reported in January resulted in the exposure of 105.8 million identities.
Twelve-Month Timeline of Data Breaches

Source: Symantec
180 160 IDENTITIES BREACHED (MILLIONS) 140 120 100 80 60 40 20 0 F M A M J J A S O N D J 2014
45 40 35 30 25 20 15 10 5 0
In the last 12 months, more than 500 million identities have been exposed.
IDENTITIES BREACHED
Top 5 Types of Information Exposed
Source: Symantec
INCIDENTS
Information Exposed in Breaches

% OF ALL BREACHES
Methodology
This data is procured from the Norton Cybercrime Index (CCI). The Norton CCI is a statistical model that measures the levels of threats, including malicious software, fraud, identity theft, spam, phishing, and social engineering daily. The data breach section of the Norton CCI is derived from data breaches that have been reported by legitimate media sources and have exposed personal information. In some cases a data breach is not publicly reported during the same month the incident occurred, or an adjustment is made in the number of identities reportedly exposed. In these cases, the data in the Norton CCI is updated. This causes fluctuations in the numbers reported for previous months when a new report is released.
Norton Cybercrime Index
Real Names Gov ID numbers (Soc Sec)
70% 39%
Birth Dates Home Address
39% 37%
Medical Records
http://us.norton.com/protect-yourself
31%
NUMBER OF INCIDENTS
The reported number of identities exposed in a late-November data breach has since been adjusted upward. This breach is now estimated to have exposed 110 million identities.
MOBILE
Mobile
At a Glance 32 percent of mobile malware discovered over the last 12 months tracks users. Traditional threats, such as back doors and downloaders are present in 14 percent of all mobile malware threats. Risks that collect data, such as device info and banking details, make up 15 percent of all risks. Three new mobile malware families were discovered in January, along with 139 new variants.
Mobile Malware by Type

Source: Symantec
32%
Track User
Risks that spy on the individual using the device, collecting SMS messages or phone call logs, tracking GPS coordinates, recording phone calls, or gathering pictures and video taken with the device.
15%
Collect Data
This includes the collection of both device- and user-specific data, such as device information, configuration data, or banking details.
15%
Send Content
These risks will send text messages to premium SMS numbers, ultimately appearing on the bill of the devices owner. Other risks can be used to send spam messages.
14%
Traditional Threats
Threats that carry out traditional malware functions, such as back doors and downloaders.
12%
Adware/Annoyance
Mobile risks that display advertising or generally perform actions to disrupt the user.
13%
Change Settings
These types of risks attempt to elevate privileges or simply modify various settings within the operating system.
Cumulative Mobile Android Malware

Source: Symantec
400 360
10000 9000
FAMILIES (CUMULATIVE)
280 240 200 160 120 80 40 F M A M J J A S O N D J 2014
7000 6000 5000 4000 3000 2000 1000
FAMILIES
VARIANTS
VARIANTS (CUMULATIVE)
320
8000
VULNERABILITIES
Vulnerabilities
At a Glance There were 555 new vulnerabilities discovered in January, bringing the total for the last 12 months to 6443. This is a 17 percent increase over the prior twelve month period. There were two vulnerabilities in mobile operating systems disclosed during the month of January. Googles Chrome browser continues to lead in reporting browser vulnerabilities, while Oracles Java leads in reported plug-in vulnerabilities.
Total Vulnerabilities Disclosed by Month

Source: Symantec
800 700 600 500 400 300 200 100 0
J 2014
Browser Vulnerabilities
Source: Symantec
Plug-in Vulnerabilities
Source: Symantec
60%
Apple Safari Google Chrome Microsoft Internet Explorer Mozilla Firefox Opera
Adobe Acrobat Reader Adobe Flash Player Apple QuickTime Oracle Sun Java
80% 70%
50%
60%
40%
50% 40% 30% 20%
30%
20%
10%
10%
SPAM, PHISHING, & MALWARE
Spam
At a Glance The global spam rate decreased 1.9 percentage points in January to 62.1 percent, down from 64.0 percent in December. Mining was the most commonly targeted industry at 64.2 percent, followed by Manufacturing at 63.2 percent. The .com top-level domain (TLD) was again the most frequently used malicious TLD in January. Sex Dating spam is the most common category, at 75.2 percent. Pharmaceutical spam came in second at 20.1 percent.
Top 5 Activity for Spam Destination by Geography

Source: Symantec
Geography
Sri Lanka Israel Brazil South Africa Kuwait
Percent
74.7% 68.8% 66.9% 65.3% 64.8%
Top 5 Activity for Spam Destination by Industry

Source: Symantec
Industry
Mining Manufacturing Agriculture, forestry & fishing Services - Professional Construction
Percent
64.2% 63.2% 62.9% 62.1% 62.1%
Top 10 Sources of Spam

Source: Symantec
Top 5 Activity for Spam Destination by Company Size

Source: Symantec
Source
Canada Spain Russian Federation United States Finland Italy Argentina India Ukraine Romania
Percent of All Spam

7.7% 6.8% 6.4% 5.9% 5.6% 5.0% 4.2% 3.7% 3.2% 3.1%
Company Size
1-250 251-500 501-1000 1001-1500 1501-2500 2501+
Percent
62.0% 61.8% 62.4% 62.2% 62.0% 62.3%
Spam by Category
Source: Symantec
Category
Sex/Dating
Percent
75.2% 20.1% 1.8% 0.8% 0.8%
Average Spam Message Size

Source: Symantec
Pharma Jobs
Month*
Dec Nov
0Kb 5Kb
28.4% 37.0%
5Kb 10Kb
19.2% 24.7%
>10Kb
52.3% 38.4%
Software Watches
*Data lags one month
Spam URL Distribution Based on Top Level Domain Name

Source: Symantec
Month*
Dec Nov
.com
33.1% 36.7%
.info
13.7% 12.4%
.ru
13.2% not listed
.biz
10.3% 9.6%
*Data lags one month
Phishing
At a Glance The global phishing rate is down in January, comprising one in 1 in 1,444 email messages. In December this rate was one in 1 in 1,053. Financial themes continue to be the most frequent subject matter, with 67.5 percent of phishing scams containing this theme. The South Africa had the highest rate in January, where one in 530 emails was a phishing scam. The United States tops the list of sources of phishing emails, responsible for distributing 39.9 percent of phishing scams. Public Administration was the most targeted industry in January, with one in every 761 emails received in this industry being a phishing scam.
Top 5 Activity for Phishing Destination by Company Size

Source: Symantec
Company Size
1-250 251-500 501-1000 1001-1500 1501-2500 2501+
Rate
1 in 1,122 1 in 1,130 1 in 1,463 1 in 1,563 1 in 1,590 1 in 1,865
Top 10 Sources of Phishing

Source: Symantec
Top 5 Activity for Phishing Destination by Industry

Source: Symantec
Source
United States Australia United Kingdom South Africa Netherlands Sweden Singapore Japan United Arab Emirates New Zealand
Percent
39.9% 27.1% 24.3% 2.4% 1.8% 1.5% 0.4% 0.3% 0.3% 0.2%
Industry
Public Administration Agriculture, forestry & fishing Services - Professional Transportation, communications, electric, gas & Sanitary Services Construction
Rate
1 in 761 1 in 874 1 in 1,189 1 in 1,457.2 1 in 1,571.5
Top 5 Activity for Phishing Destination by Geography

Source: Symantec
Geography
South Africa United Kingdom Australia Austria New Zealand
Rate
1 in 540 1 in 731 1 in 821 1 in 1,183 1 in 1,215
Phishing Distribution
Source: Symantec
Organizations Spoofed in Phishing Attacks

Source: Symantec
Phishing Distribution:
Automated Toolkits
Organizations Spoofed in Phishing Attacks:

58.1%
Financial
Other Unique Domains
36.3%
IP Address Domains
67.5%
Information Services
3.2%
Free Web Hosting Sites
29.1%
Retail
1.6%
Typosquatting
3.6%
Computer Software
0.7%
0.9%
Communications
0.1%
Malware
At a Glance
Top 10 Email Virus Sources

Source: Symantec
The global average virus rate in January was one in 431 emails, compared to one in 164 in December. Hungary topped the list of geographies, with one in 217 emails containing a virus. The United States was the largest source of virus-laden emails, making up 66.5 percent of all email-based viruses. Organizations with 250-500 employees were the most targeted company size, where one and 383 emails contained a virus. Geography
United States United Kingdom Australia Netherlands France Germany Japan South Africa Canada Hong Kong
Percent
66.5% 15.0% 4.1% 2.1% 1.8% 1.2% 1.2% 1.1% 0.9% 0.7%
Proportion of Email Traffic in Which Virus Was Detected

Source: Symantec
1 in 0 1 in 50 1 in 100 1 in 150 1 in 200 1 in 250 1 in 300 1 in 350 1 in 400 1 in 450 1 in 500

F M A M J J A S O N D J 2014
Top 5 Activity for Malware Destination by Industry

Source: Symantec
Top 5 Activity for Malware Destination by Geographic Location

Source: Symantec
Industry
Public Administration Agriculture, forestry & fishing Services - Professional Wholesale Services - Non Traditional
Rate
1 in 309 1 in 332 1 in 343 1 in 397 1 in 467
Geography
Hungary South Africa United Kingdom Hong Kong Ireland
Rate
1 in 217 1 in 221 1 in 287 1 in 306 1 in 344
Top 5 Activity for Malware Destination by Company Size

Source: Symantec
Company Size
1-250 251-500 501-1000 1001-1500 1501-2500 2501+
Rate
1 in 398 1 in 383 1 in 459 1 in 396 1 in 475 1 in 459
Endpoint Security
At a Glance Variants of W32.Ramnit accounted for 9.4 percent of all malware blocked at the endpoint. In comparison, 6.1 percent of all malware were variants of W32.Sality. Approximately 49.5 percent of the most frequently blocked malware last month was identified and blocked using generic detection.
Top 10 Most Frequently Blocked Malware

Source: Symantec
Malware
W32.Sality.AE W32.Ramnit!html W32.Almanahe.B!inf W32.Downadup.B W32.Ramnit.B Trojan.Zbot W32.Ramnit.B!inf W32.SillyFDC W32.Virut.CF W32.SillyFDC.BDP!lnk
Percent
5.4% 3.8% 3.4% 3.4% 3.1% 2.5% 2.2% 1.7% 1.7% 1.0%
Policy Based Filtering
At a Glance The most common trigger for policy-based filtering applied by Symantec Web Security .cloud for its business clients was for the Social Networking category, which accounted for 51.7 percent of blocked Web activity in January. Advertisement & Popups was the second-most common trigger, comprising 20.5 percent of blocked Web activity.
Policy Based Filtering

Source: Symantec
Category
Social Networking Advertisement & Popups Streaming Media Hosting Sites Computing & Internet Chat Search Gambling News Entertainment
Percent
51.7% 20.5% 4.3% 3.2% 2.8% 1.9% 1.5% 1.0% 0.9% 0.8%
About Symantec
Symantec protects the worlds information and is a global leader in security, backup, and availability solutions. Our innovative products and services protect people and information in any environmentfrom the smallest mobile device to the enterprise data center to cloudbased systems. Our world-renowned expertise in protecting data, identities, and interactions gives our customers confidence in a connected world. More information is available at www.symantec.com or by connecting with Symantec at go.symantec.com/socialmedia.
More Information
Security Response Publications: http://www.symantec.com/security_response/publications/ Internet Security Threat Report Resource Page: http://www.symantec.com/threatreport/ Symantec Security Response: http://www.symantec.com/security_response/ Norton Threat Explorer: http://us.norton.com/security_response/threatexplorer/ Norton Cybercrime Index: http://us.norton.com/cybercrimeindex/
Confidence in a connected world.
For specific country offices and contact numbers, please visit our website. For product information in the U.S., call toll-free 1 (800) 745 6054. Symantec Corporation World Headquarters 350 Ellis Street Mountain View, CA 94043 USA +1 (650) 527 8000 1 (800) 721 3934 www.symantec.com
Copyright 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Symantec Intelligence Report., January 2014

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Symantec Intelligence Report., January 2014

Enviado por

Direitos autorais:

Formatos disponíveis

SYMANTEC INTELLIGENCE REPORT

p. 2 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 3 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 4 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 5 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Overall Email Phishing Rate:

Estimated Global Email Spam Rate Per Day

Nov Dec Jan

1 in 1,311 1 in 1,053 1 in 1,444

62% 64% 62%

Overall Email Virus Rate:

Nov Dec Jan

1 in 253 1 in 164 1 in 431

Nov Dec Jan

p. 6 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Mobile Malware Variants

8000 7000 6000 5000 4000 3000 2000 1000 0 J F M A M J J A S O N

p. 7 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 8 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Targeted Attacks per Day

250 225 200

First Attacks Logged by Month

p. 9 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Attacks by Size of Targeted Organization

First Attacks Logged by Size

Top 10 Industries Attacked

File Extensions of Attachments

11.0% 5.9% 4.2% 3.2% 2.2% 1.5%

.pdf .dat .com .rtf .zip

p. 10 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 11 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Top 5 Social Media Attacks

Top 5 Social Media Attacks

82% 8% Likejacking 5% Manual Sharing 2% Fake Apps 2% Comment Jacking

p. 12 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 13 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Twelve-Month Timeline of Data Breaches

180 160 IDENTITIES BREACHED (MILLIONS) 140 120 100 80 60 40 20 0 F M A M J J A S O N D J 2014

Information Exposed in Breaches

Real Names Gov ID numbers (Soc Sec)

Birth Dates Home Address

p. 14 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 15 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Mobile Malware by Type

p. 16 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Cumulative Mobile Android Malware

280 240 200 160 120 80 40 F M A M J J A S O N D J 2014

7000 6000 5000 4000 3000 2000 1000

p. 17 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

p. 18 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Total Vulnerabilities Disclosed by Month

800 700 600 500 400 300 200 100 0

50% 40% 30% 20%

p. 19 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

SPAM, PHISHING, & MALWARE

p. 20 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Top 5 Activity for Spam Destination by Geography

Top 5 Activity for Spam Destination by Industry

p. 21 Symantec Corporation Symantec Intelligence Report :: JANUARY 2014

Top 10 Sources of Spam

Top 5 Activity for Spam Destination by Company Size

Percent of All Spam

Average Spam Message Size

*Data lags one month