Symantec Internet Security Threat Report Identifies More Attacks Now Targeting e-Commerce, Web Applications

News Release

Short Vulnerability-to-Exploit Window, Rise in Bot Networks, Increase in Severe/Easy-to-Exploit Vulnerabilities

CUPERTINO, Calif. – Sept. 20, 2004 - Symantec Corp. (Nasdaq: SYMC), the global leader in information security, today released its newest Internet Security Threat Report. The sixth bi-annual report provides analysis and discussion of trends in Internet attacks, vulnerabilities, and malicious code activity for the period of Jan. 1, 2004 to June 30, 2004.

“As this latest Internet Security Threat Report demonstrates, exploits are being created more easily and faster than ever, while attackers are launching more sophisticated attacks for financial gain,” said Arthur Wong, vice president, Symantec Security Response and Managed Security Services. “Software vulnerabilities and targeted attacks remain a primary area of concern for organizations and individuals. By publishing a comprehensive and accurate update on Internet threat activity, Symantec is providing the information security community the information needed to effectively secure systems now and in the future.”

Key Findings

Increased Threats to e-Commerce: During this reporting period, e-Commerce was the single most targeted industry, with nearly 16 percent of attacks against it. This represents a 400-percentage increase from the four percent reported during the previous six months. This rise may indicate a shift from attacks motivated by notoriety to attacks motivated by economic gain. This possibility is further illustrated by an increase in phishing scams and spyware designed to steal confidential information and pass it along to attackers.

Attacks Against Web Application Technologies Are Increasingly Popular: Web application technologies are appealing targets for attacks because of their widespread deployment within organizations and the relative ease with which they can be exploited. Web applications allow attackers to gain access to the target system simply by penetrating one end-user’s computer, bypassing traditional perimeter security measures. Nearly 82 percent of documented Web application vulnerabilities were classified as easy to exploit, thereby representing a significant threat to an organization’s infrastructure and critical information assets.

Short Time Between Vulnerability and Exploit: According to the report, the time between the announcement of a vulnerability and the release of associated exploit code was extremely short. Symantec data indicates that over the past six months, the average vulnerability-to-exploit window was just 5.8 days. Once an exploit has been released, the vulnerability is often widely scanned for and quickly exploited. This short window leaves organizations with less than a week to patch vulnerable systems.

Rise in Bot Networks: Adding to concern about the short vulnerability-to-exploit window is the growth in bots (short for “robot”). Bots are programs that are covertly installed on a targeted system, allowing an unauthorized user to remotely control the computer for a wide variety of purposes. Attackers often coordinate large groups of bot-controlled systems, or bot networks, to scan for vulnerable systems and use them to increase the speed and breadth of their attacks. Over the past six months, Symantec has seen a large increase in the number of remotely controlled bots. During the first six months of 2004, the average number of monitored bots rose from under 2,000 to more than 30,000 per day – peaking at 75,000 in one day. Bot networks create unique problems for organizations because they can be remotely upgraded with new exploits very quickly, which could potentially allow attackers to outpace an organization’s security efforts to patch vulnerable systems.

Increase in Severe, Easy-to-Exploit Vulnerabilities: Symantec documented more than 1,237 new vulnerabilities between January 1 and June 30, 2004, an average of 48 new vulnerabilities per week. Seventy percent of these vulnerabilities were considered easy to exploit, and 96 percent were considered moderately or highly severe. Consequently, organizations must contend with an average of more than seven new vulnerabilities per day, and a significant percentage of these vulnerabilities could result in a partial or complete compromise of the targeted system.

Attack Trends

The Slammer worm was the most common attack over the past six months, with 15 percent of attacking IP addresses performing an attack related to it. Gaobot and its variants were the second most common attack, increasing by more than 600 percent over the past six months.
Overall, the daily volume of attacks is decreasing due to a decline in Internet-based worm attack activity over the first six months of 2004. E-Commerce received the most targeted attacks of any industry during this period; small business received the second most.
The United States was the top attack source country with 37 percent, down from 58 percent in the previous six months. Other countries rose accordingly, indicating that attack activity is becoming more international.
Eighty-seven percent of Symantec Managed Security Services clients with tenure of more than six months successfully avoided experiencing a severe attack.

Vulnerability Trends

During the first six months of 2004, the average time between the public disclosure of a vulnerability and the release of an associated exploit was 5.8 days.
The Symantec Vulnerability Database documented 1,237 new vulnerabilities between January 1 and June 30, 2004. Ninety-six percent of documented vulnerabilities disclosed during this period were rated as moderately or highly severe; 70 percent of vulnerabilities were considered easy to exploit; 64 percent of vulnerabilities for which exploit code is available were considered high severity.
In the first half of 2004, 479 vulnerabilities – or 39 percent of the total volume – were associated with Web application technologies.

Malicious Code Trends

Over the past six months, Symantec documented more than 4,496 new Windows viruses and worms (particularly Win32), more than 4.5 times the number in the same period in 2003.
The number of distinct variants of bots is rising dramatically, increasing by 600 percent over the past six months.
Peer-to-peer services (P2P), Internet relay chat (IRC), and network file sharing continue to be popular propagation vectors for worms and other malicious code.
Adware is becoming more problematic, making up six of the top 50 malicious code submissions.
The first malicious worm for mobile devices, Cabir, was developed.

Future and Emerging Trends

Client-side attacks are expected to increase in the near future. Targeted attacks on firewalls, routers, and other security devices protecting users’ systems are also a growing security concern.
Symantec expects bot networks to employ increasingly sophisticated methods of control and attack synchronization that are difficult to detect and locate. Symantec also expects to see instances of port knocking, a method attackers may use to create direct connections to potential target systems.
Symantec expects that recent Linux and BSD vulnerabilities that have been discovered and used in proof-of-concept exploits will be used as exploit-based worms in the near future. Symantec also expects to see more attempts to exploit mobile devices.

About the Symantec Internet Security Threat Report
Symantec has some of the most comprehensive sources of threat data in the world. The findings of the Internet Security Threat Report are based on data from Symantec DeepSight Threat Management System and Symantec Managed Security Services customers as well as from 20,000 security devices deployed in more than 180 countries. In addition, the report leverages threat data gathered by experts in Symantec’s five Security Operations Centers and nine Response Labs throughout the world. Symantec also gathers malicious code from more than 120 million client, server, and gateway systems that have deployed Symantec’s antivirus products in both consumer and corporate environments.

About Symantec
Symantec is the world leader in providing solutions to help individuals and enterprises assure the security, availability, and integrity of their information. Headquartered in Cupertino, Calif., Symantec has operations in more than 40 countries. More information is available at www.symantec.com.

NOTE TO EDITORS: : If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site. All prices noted are in US dollars and are valid only in the United States.

Symantec, the Symantec logo, VERITAS, and the VERITAS logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the United States and certain other countries. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.

http://www.symantec.com/press/2004/n040920b.html