Security Response Blog

Our security research centers around the world provide unparalleled analysis of and protection from malware, security risks, vulnerabilities, and spam.

• 0

  Created: Ben Nahorney 16 May 2013 13:15:01 GMT

  Spam Campaigns Take to Tumblr

  As the urban legend goes, the bank robber Willie Sutton was asked why he robbed banks. “Because that’s where the money is,” he is attributed as saying. While Sutton has long since distanced himself from the statement, the concept resonates with many people, to the extent that it’s been used to describe principles in accounting and even medicine.   This principle also holds true in the world of Internet security. In the latest version of the Internet Security Threat Report we discussed the major trends in the spam world, where the percent of spam email continues to decline while more and more social networks are being targeted. Given the growth of social networking in recent years as a means to communicate, this...
• 0

  Created: Kevin Haley 20 Apr 2011 20:28:37 GMT

  Twitter Chat on the Internet Security Threat Report

  The Internet is now a veritable minefield of malware, and it’s becoming more and more difficult to navigate. Every year, hundreds of millions of new threats appear and cybercriminals are constantly changing tactics hoping to catch users off-guard. On Tuesday, April 26 at 10 a.m. PST, join me and Marc Fossi for a live Twitter discussion on the latest Internet Security Threat Report. We will discuss the report and answer your questions using the #SecChat hash tag. This year’s report notes that Symantec detected more than 286 million new threats in 2010. This number grows every year, and in 2011, some of these threats will be pointed toward you. Many companies found that to be the case last year. The ISTR covers the trends and tricks used in targeted and massive attacks by cybercriminals. Among the trends from the report to be discussed will be the proliferation of attack kits - pre-written...
• 0

  Created: M.K. Low 07 Apr 2011 03:47:54 GMT

  Taking the Shortcut to Malicious Attacks

  Taking the Shortcut to Malicious Attacks  Shortened URLs have become popular in recent years as a means of conserving space in character-limited text fields, such as those used for micro-blogging. Some URLs consist of a substantial number of characters that can eat up character limits, break the flow of text, or cause distortions in how Web pages are rendered for users. URL shortening services allow people to submit a URL and receive a second, specially coded shortened URL that redirects to the original URL. When a user clicks on the shortened URL, the service will redirect the person to the submitted Web page. Attackers are taking advantage of this type of service because it helps to hide the actual destination URL. Attackers use the shortened links, which may or may not be legitimate, to lead unwitting users to malicious websites that are designed to attack any system using a vulnerable browser.  Social networks are a security concern for...
• 0

  Created: David McKinney 06 Apr 2011 07:00:20 GMT

  Vulnerabilities Abound in 2010

  Volume 16 of the Symantec Internet Security Threat Report covers trends in the Internet security threat landscape during 2010. It has been an interesting year, to say the least. We saw vulnerabilities implicated in major events such as the Trojan.Hydraq Incident, the Stuxnet attacks, and numerous zero-day attacks. Here are some highlights: -          In terms of the sheer number of new vulnerabilities discovered, 2010 was a record year. At the time of writing, we documented 6,253 new vulnerabilities over the year. -          The rise in vulnerabilities was influenced by an increase in the number of new vendors that were affected by vulnerabilities in 2010. In 2010, Symantec documented 1,914 new vendors that were impacted by vulnerabilities, compared to 734 new vendors in 2009. -    ...
• 0

  Created: Téo Adams 05 Apr 2011 03:56:08 GMT

  The Symantec Internet Security Threat Report (ISTR) Volume 17 Is Here!

  We are pleased to announce that Volume 17 of the Symantec Internet Security Threat Report (ISTR) is now available. There are some significant changes to the report this year, including several new metrics, a revamping of existing metrics, and a revised format. Aspects of the new format were first seen in the Report on Attack Kits and Malicious Websites, which was released earlier this year. One point of interest in this most recent report is the continued prevalence of malicious code propagation through the sharing of malicious executables on removable media. This propagation mechanism has been ranked at the top for quite some time now, with no signs of coming down. However, in February 2011, right in midst of writing the report, we read an...
• 0

  Created: Kevin Haley 05 Apr 2011 03:55:29 GMT

  2011 Internet Security Threat Report Identifies Increased Risks for SMBs

  2011 Internet Security Threat Report Identifies Increased Risks for SMBs Kevin Haley, Director, Symantec Security Technology and Response Small businesses have flexibility that can provide them with a competitive edge in today’s Internet-based market. And, with ever more business being conducted online, keeping your sensitive information safe is more critical than ever. Hackers do not care what the size of your business is. They only care if they can get past your defenses and relieve you of your valuables. What hackers do like about a small business is that they tend to have more money in the bank than an end-user and less cyber defenses than a larger company. And these hackers are no longer limited to highly skilled computer geeks. Using easily available attack toolkits, even a relative novice can infect your computers and extract all the information they...
• 0

  Created: Kevin Haley 11 Feb 2011 12:52:25 GMT

  Caught You Clickin’

  For those of you who arrived on this page after clicking on our Bit.ly link, we caught you clicking! Not that we blame you, though. After all, everyone loves clicking on links! However, this just goes to show why social engineering is as effective in spreading malware today as it was exactly ten years ago, when the Anna Kournikova virus sped across the Internet almost as fast as the tennis star’s serve. The virus was so successful because, well, let’s face it, everyone wanted to check out the athletic beauty’s latest picture. In the end, though, all they got was a malware infection and a hard life lesson: "curiosity killed the cat." The fact of the matter is that not much has changed in this regard. Today, just about anyone or anything making headlines seems to be fair game for malware authors and phishers to exploit. The popularity of shortened URLs...
• 0

  Created: Brent Graveland 20 Jan 2011 14:40:04 GMT

  Fully Undetectable Cryptors and the Antivirus Detection Arms Race

  Antivirus companies and malicious software makers are in a continual battle. Antivirus developers attempt to identify and block malicious software, and the malicious software developers want to evade detection so their products can succeed to earn them money. The recently released Symantec Report on Attack Toolkits and Malicious Websites discusses how malicious software is increasingly being bundled into attack kits and how those kits are being sold in the underground economy and used in a majority of online attacks. One aspect of the report discusses the various forms of obfuscation methods built into these kits to avoid detection by antivirus sensors and researchers. A major part of this obfuscation arms race is called a “FUD cryptor.” FUD in this case does not stand for “fear, uncertainty, and doubt,” but rather for “fully undetectable” or...
• 0

  Created: Téo Adams 18 Jan 2011 13:44:52 GMT

  Careful What You Search For

  Search results and malicious websites Among the many excuses I’ve heard from people who take computer security too lightly, or who brush off the likelihood of being targeted by Web attacks, are comments such as “I don’t search for anything bad,” or “I only visit sites I know.” I find this sort of attitude very frustrating, if not amusing, and I like coming across bits of information that I can use to educate these people. So, I was especially interested in the results of some related data analysis that I worked on for on the recently released Symantec Report on Attack Kits and Malicious Websites. One of the metrics we use in the report examines Web search terms and the number of times the use of each search term resulted in a user visiting a malicious website. The range of search terms was unrestricted and consisted of both...
• 0

  Created: Greg Ahmad 30 Apr 2010 12:49:13 GMT

  A Rise in Java Vulnerabilities

  Web browsers are an integral part of home and business computing environments and one of the most popular and ubiquitous applications on computer systems. Due to their popularity, the exploitation of security vulnerabilities in browsers is a common method for attackers to compromise computers. Vulnerabilities in browsers and browser plug-ins facilitate the propagation of malware, as well as aid in other attacks such as fraud and the theft of sensitive information. Not only are these issues used to compromise computers in targeted attacks, but vulnerabilities affecting browser applications are also exploited en masse by malware, bot networks, and exploit toolkits. Nowadays, attacks that take advantage of vulnerabilities in browsers and other associated applications such as browser plug-ins are very common. According the recent Symantec Global...