SINGAPORE -- 7 March, 2006 - Symantec Corp. (Nasdaq: SYMC) today released its ninth volume of the Internet Security Threat Report, one of the most comprehensive sources of Internet threat data in the world. The semiannual report, covering the six-month period from July 1, 2005 to Dec. 31, 2005, marks an increase in threats designed to facilitate cybercrime.
While past attacks were designed to destroy data, today’s attacks are increasingly designed to silently steal data for profit without doing noticeable damage that would alert a user to its presence. In the previous Internet Security Threat Report, Symantec cautioned that malicious code for profit was on the rise, and this trend continued during the second half of 2005. Malicious code threats that could reveal confidential information rose from 74 percent of the top 50 malicious code samples last period to 80 percent this period.
“Cybercrime represents today’s greatest threat to consumers’ digital lifestyle and to online businesses in general,” said Arthur Wong, vice president, Symantec Security Response and Managed Security Services. “The unparalleled insight this report provides into how cybercrime is happening and how it can be prevented enables Symantec to help protect the widest variety of customers in the world.”
The report also details the growing trend of attackers using bot networks, targeted attacks on Web applications and Web browsers, and modular malicious code. Based on this and data from previous reporting periods, Symantec expects to see more diverse and sophisticated threats used for cybercrime as well as an increase in the theft of confidential, financial, and personal information for financial gain.
Crimeware Tools Expand Reach, Function
Cybercrime-related threats are gaining momentum through the use of crimeware, software tools built with the purpose of committing online scams and stealing information from consumers and businesses. As Symantec noted in the previous Internet Security Threat Report, attackers are moving away from large, multiple purpose attacks against traditional security devices such as firewalls and routers. Instead, they are focusing their efforts on regional targets, desktops, and Web applications that may allow an attacker to steal corporate, personal, financial, or confidential information; this information could then be used for additional criminal activity.
Programs that provide attackers with unauthorized control of a computer, known as bots, also contribute to the rise in cybercrime threats. While the number of bot-infected computers is 11 percent lower than last period—with an average of 9,163 infected systems identified each day during the current reporting period—bot networks are increasingly used for criminal activities such as denial of service (DoS)-based extortion attempts. Symantec estimates that this measurement is only capturing a portion of global activity and that the actual infection numbers are likely to be much higher. On average, Symantec observed 1,402 DoS attacks per day, a 51 percent increase over the previous reporting period. Symantec speculates that this growth trend will continue as attackers leverage an increasing number of Web-based application and browser vulnerabilities.
In the previous report, Symantec speculated that attacks directed at Web applications would increase. During the current reporting period, 69 percent of the vulnerabilities reported to Symantec affected Web application technologies, a 15 percent increase over the previous period. Web application technologies, which rely on a browser for their user interface, present an easier target for attackers due to their availability over commonly allowed protocols such as HTTP.
Symantec has also seen an increase in modular malicious code, which initially possesses limited functionality but is designed to update itself with new, more damaging capabilities. Modular malicious threats often expose confidential information that can then be used in identity theft, credit card fraud, or other criminal financial activities. During the last six months of 2005, modular malicious code accounted for 88 percent of the top 50 malicious code samples reported to Symantec, up from 77 percent last period.
Additional Key Findings
About the Symantec Internet Security Threat Report
The Symantec Internet Security Threat Report provides analysis of network-based attacks, a review of known vulnerabilities, and highlights of malicious code and additional security risks. Employing the Symantec Global Intelligence Network, Symantec identifies and analyzes emerging trends in Internet security activity. This unparalleled pool of data includes the following:
Symantec is the world leader in providing solutions to help individuals and enterprises assure the security, availability, and integrity of their information. Headquartered in Cupertino, Calif., Symantec has operations in more than 40 countries. More information is available at www.symantec.com.
NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please visit the Symantec News Room at http://www.symantec.com/news. All prices noted are in US dollars and are valid only in the United States.
Symantec, the Symantec logo, VERITAS, and the VERITAS logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the United States and certain other countries. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.