Internet security threat heightened

This is a particular concern for South Africa as Symantec observed an increase in phishing activity during major holidays and other large events such as the FIFA World Cup.

“As 2010 draws closer, South Africans are likely to increasingly use the Internet to search for news updates and travel packages to games as well as correspond with friends and family to mention but a few – placing themselves at great risk,” said Patrick Evans, regional director of Symantec Africa.

“To that end, South Africans need to have an understanding of the various software tools that hackers commonly use in their cybercrime activities. This report provides enterprises and consumers with the information they need to effectively secure their systems now and in the future.”

Shift to global online criminal communities

Cyber criminals continue to refine their attack methods in an attempt to remain undetected and to create global, co-operative networks to support the ongoing growth of criminal activity.

Symantec’s Internet Security Threat Report Volume XI reveals:

1. Symantec reported more than 6 million distinct bot-infected computers worldwide during the second half of 2006, representing a 29 % increase from the previous period. However, the number of command-and-control servers used to relay commands to these bots decreased by 25%, indicating that bot network owners are consolidating their networks and increasing the size of their existing networks.

2. Trojans constituted 45% of the top 50 malicious code samples, representing a 23% increase over the first six months of 2006. This significant increase supports Symantec’s forecast from previous research, which noted that attackers appeared to be making a shift away from mass-mailing worms toward using Trojans.

3. Symantec documented 12 zero-day vulnerabilities during the second half of 2006, marking a significant increase from the one zero-day vulnerability documented in the first half of 2006, increasing the exposure of consumers and businesses to unknown threats.

4. Underground Economy Servers are being used by criminals and criminal organisations to sell stolen information, including government-issued identity numbers, credit cards, bank cards and personal identification numbers (PINs), user accounts, and email address lists.

5. Theft or loss of a computer or data storage medium, such as a USB memory key, made up 54% of all identity theft-related data breaches.
   

For the first time, Symantec identified the countries with the highest amount of malicious activity originating from their networks. The US had the highest proportion of overall malicious activity, with 31%; China was second, with 10%; and Germany was third, with 7%.

“As cyber criminals become increasingly malicious, they continue to evolve their attack methods to become more complex and sophisticated in order to prevent detection,” said Patrick Evans, regional director of Symantec Africa. “End users, whether consumers or enterprises, need to ensure proper security measures to prevent an attacker from gaining access to their confidential information, causing financial loss, harming valuable customers, or damaging their own reputation.”

Threats to confidential info

For the first time, Symantec tracked the trade of stolen confidential information and captured data frequently sold on underground economy servers. These servers are often used by hackers and criminal organisations to sell stolen information, including social security numbers, credit cards, personal identification numbers (PINs), and email address lists. During the last six months of 2006, 51% of all known underground economy servers in the world were located in the US.

During the reporting period, Symantec observed a rise in threats to confidential information due to the increase of Trojans and bot networks enabling an attacker to gain access to a victim’s computer. Attacks that obtain sensitive data stored on an infected computer can result in significant financial loss, particularly if credit card or banking information is exposed. Threats to confidential information made up 66% of the top 50 malicious code reported to Symantec, an increase over the 48% reported in the previous period. Threats that could export user data, such as user names and passwords, accounted for 62% of threats to confidential information during the second half of 2006, up from 38% in the first half of the year.

Data breaches aid identity theft

Confidential information used in identity theft is often confiscated as a result of a data breach. During the reporting period, Symantec assessed data breaches that resulted from hacker activity, the theft or loss of computer hardware, and security policy failure. Data breaches and the potential use of confidential information for identity theft can result in a loss of public confidence, legal liability, or costly litigation. The majority of global data breaches affected the government sector, accounting for 25% of the total. Government organisations may be considered a prime target as they often store data in many separate locations making it accessible to various people, and thereby increasing the opportunities for attackers to gain unauthorised access.

Sophisticated spam and online fraud

Symantec observed high levels of coordinated attacks combining spam, malicious code, and online fraud. During the second half of 2006, spam made up 59% of all monitored email traffic marking a steady increase over the first six months of 2006, with 30% of the total spam related to the financial services industry resulting from an increase in “pump-and-dump” spam.

During a “pump-and-dump” scheme, cyber criminals profit by purchasing stock when it is low and then artificially pumping up interest in the stock by sending out spam containing false predictions of high performance for the stock. Spam recipients trust the content and buy the stock, creating demand and resulting in a rise in the stock price. When the stock price increases, the cyber criminals sell their stock for a profit.

Over the last six months of 2006, Symantec detected a total of 166,248 unique phishing messages, an average of 904 per day, marking a 6% increase over the first six months of 2006. For the first time, Symantec analysed the effects that the day of the week and seasonal events may have had on phishing attacks.

Throughout 2006, Symantec detected an average of 27% fewer unique phishing messages on weekends than the average of 961 phishing messages on the weekdays. This trend indicates that phishing activity mirrors the business week where attackers attempt to mimic a legitimate company’s email practices. However, this pattern may also indicate that phishing campaigns are short lived and most effective when victims receive and read the phishing emails shortly after they were distributed. As already highlighted above, Symantec observed an increase in phishing activity during major holidays and other large events, such as the FIFA World Cup. This is due to the fact that attackers may find it easier to craft theme specific social engineering attacks surrounding special events.

The semiannual Symantec Internet Security Threat Report (ISTR) Volume XI covers the six-month period from July 1, 2006, through December 31, 2006. It is based on Symantec data collected from more than 40 000 sensors deployed in more than 180 countries in addition to a database that covers more than 20 000 vulnerabilities affecting more than 30 000 technologies from more than 4000 vendors. Symantec also reviews more than 2 million decoy accounts that attract email messages from 20 different countries around the world allowing Symantec to gauge global spam and phishing activity. To provide enhanced insight into the evolving threat landscape, this volume of the report includes several new metrics, such as the window of exposure for Web browsers and the proportion of previously unseen malicious code. The full Internet Security Threat Report includes additional statistics and detail and is available for download at www.symantec.com/threatreport/.