Symantec Internet Security Threat Report Identifies More Attacks Now Targeting e-Commerce, Web Applications

Short Vulnerability-to-Exploit Window, Rise in Bot Networks, Increase in Severe/Easy-to-Exploit Vulnerabilities

TORONTO, ON - September 20, 2004 - Symantec Corp. (Nasdaq: SYMC), the global leader in information security, today released its newest Internet Security Threat Report. The sixth bi-annual report provides analysis and discussion of trends in Internet attacks, vulnerabilities, and malicious code activity for the period of Jan. 1, 2004 to June 30, 2004.

"As this latest Internet Security Threat Report demonstrates, exploits are being created more easily and faster than ever, while attackers are launching more sophisticated attacks for financial gain," said Arthur Wong, vice president, Symantec Security Response and Managed Security Services. "Software vulnerabilities and targeted attacks remain a primary area of concern for organizations and individuals. By publishing a comprehensive and accurate update on Internet threat activity, Symantec is providing the information security community the information needed to effectively secure systems now and in the future."

Key Findings
Increased Threats to e-Commerce: During this reporting period, e-Commerce was the single most targeted industry, with nearly 16 percent of attacks against it. This represents a 400-percentage increase from the four percent reported during the previous six months. This rise may indicate a shift from attacks motivated by notoriety to attacks motivated by economic gain. This possibility is further illustrated by an increase in phishing scams and spyware designed to steal confidential information and pass it along to attackers.

Attacks Against Web Application Technologies Are Increasingly Popular: Web application technologies are appealing targets for attacks because of their widespread deployment within organizations and the relative ease with which they can be exploited. Web applications allow attackers to gain access to the target system simply by penetrating one end-user's computer, bypassing traditional perimeter security measures. Nearly 82 percent of documented Web application vulnerabilities were classified as easy to exploit, thereby representing a significant threat to an organization's infrastructure and critical information assets.

Short Time Between Vulnerability and Exploit: According to the report, the time between the announcement of a vulnerability and the release of associated exploit code was extremely short. Symantec data indicates that over the past six months, the average vulnerability-to-exploit window was just 5.8 days. Once an exploit has been released, the vulnerability is often widely scanned for and quickly exploited. This short window leaves organizations with less than a week to patch vulnerable systems.

Rise in Bot Networks: Adding to concern about the short vulnerability-to-exploit window is the growth in bots (short for "robot"). Bots are programs that are covertly installed on a targeted system, allowing an unauthorized user to remotely control the computer for a wide variety of purposes. Attackers often coordinate large groups of bot-controlled systems, or bot networks, to scan for vulnerable systems and use them to increase the speed and breadth of their attacks. Over the past six months, Symantec has seen a large increase in the number of remotely controlled bots. During the first six months of 2004, the average number of monitored bots rose from under 2,000 to more than 30,000 per day - peaking at 75,000 in one day. Bot networks create unique problems for organizations because they can be remotely upgraded with new exploits very quickly, which could potentially allow attackers to outpace an organization's security efforts to patch vulnerable systems.

Increase in Severe, Easy-to-Exploit Vulnerabilities: Symantec documented more than 1,237 new vulnerabilities between January 1 and June 30, 2004, an average of 48 new vulnerabilities per week. Seventy percent of these vulnerabilities were considered easy to exploit, and 96 percent were considered moderately or highly severe. Consequently, organizations must contend with an average of more than seven new vulnerabilities per day, and a significant percentage of these vulnerabilities could result in a partial or complete compromise of the targeted system.

Attack Trends

• The Slammer worm was the most common attack over the past six months, with 15 percent of attacking IP addresses performing an attack related to it. Gaobot and its variants were the second most common attack, increasing by more than 600 percent over the past six months.
  
  
• Overall, the daily volume of attacks is decreasing due to a decline in Internet-based worm attack activity over the first six months of 2004. E-Commerce received the most targeted attacks of any industry during this period; small business received the second most.
  
  
• The United States was the top attack source country with 37 percent, down from 58 percent in the previous six months. Other countries rose accordingly, indicating that attack activity is becoming more international.
  
  
• Eighty-seven percent of Symantec Managed Security Services clients with tenure of more than six months successfully avoided experiencing a severe attack.

Vulnerability Trends

• During the first six months of 2004, the average time between the public disclosure of a vulnerability and the release of an associated exploit was 5.8 days.
  
  
• The Symantec Vulnerability Database documented 1,237 new vulnerabilities between January 1 and June 30, 2004. Ninety-six percent of documented vulnerabilities disclosed during this period were rated as moderately or highly severe; 70 percent of vulnerabilities were considered easy to exploit; 64 percent of vulnerabilities for which exploit code is available were considered high severity.
  
  
• In the first half of 2004, 479 vulnerabilities - or 39 percent of the total volume - were associated with Web application technologies.

Malicious Code Trends

• Over the past six months, Symantec documented more than 4,496 new Windows viruses and worms (particularly Win32), more than 4.5 times the number in the same period in 2003.
  
  
• The number of distinct variants of bots is rising dramatically, increasing by 600 percent over the past six months.
  
  
• Peer-to-peer services (P2P), Internet relay chat (IRC), and network file sharing continue to be popular propagation vectors for worms and other malicious code.
  
  
• Adware is becoming more problematic, making up six of the top 50 malicious code submissions.
  
  
• The first malicious worm for mobile devices, Cabir, was developed.
  
  

Future and Emerging Trends

• Client-side attacks are expected to increase in the near future. Targeted attacks on firewalls, routers, and other security devices protecting users' systems are also a growing security concern.
  
  
• Symantec expects bot networks to employ increasingly sophisticated methods of control and attack synchronization that are difficult to detect and locate. Symantec also expects to see instances of port knocking, a method attackers may use to create direct connections to potential target systems.
  
  
• Symantec expects that recent Linux and BSD vulnerabilities that have been discovered and used in proof-of-concept exploits will be used as exploit-based worms in the near future. Symantec also expects to see more attempts to exploit mobile devices.

About the Symantec Internet Security Threat Report
Symantec has some of the most comprehensive sources of threat data in the world. The findings of the Internet Security Threat Report are based on data from Symantec DeepSight Threat Management System and Symantec Managed Security Services customers as well as from 20,000 security devices deployed in more than 180 countries. In addition, the report leverages threat data gathered by experts in Symantec's five Security Operations Centers and nine Response Labs throughout the world. Symantec also gathers malicious code from more than 120 million client, server, and gateway systems that have deployed Symantec's antivirus products in both consumer and corporate environments.

About Symantec
Symantec, the world leader in Internet security technology, provides a broad range of content and network security software and appliance solutions to individuals, enterprises and service providers. The company is a leading provider of client, gateway and server security solutions for virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and e-mail filtering, remote management technologies and security services to enterprises and service providers around the world. Symantec's Norton brand of consumer security products is a leader in worldwide retail sales and industry awards. Headquartered in Cupertino, Calif., Symantec has worldwide operations in 36 countries. For more information, please visit www.symantec.com.

Symantec's Canadian operations are headquartered in Toronto with offices in Montreal, Ottawa, Calgary and Vancouver. For more information on Symantec products or current promotions, contact the Canadian office at (416) 441-3676 or access Symantec's Canadian Web site at www.symantec.ca. Symantec is an active member of the Canadian Alliance Against Software Theft (CAAST).

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site. All prices noted are in US dollars and are valid only in the United States.

Symantec and the Symantec logo are trademarks or registered trademarks, in the United States and certain other countries, of Symantec Corporation. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.