internet security tHreAt rePOrt GOVernMent 2013

p. 101
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
MALICIOUS CODE TRENDS
Commentary
• Ramnit again beats Sality to become the most prevalent
malicious code family in 2012. Ranked first again in 2011,
the top malicious code family by volume of potential
infections in 2012 was Ramnit.
Samples of the Ramnit family of malware were responsible
for significantly more potential infections (15.4 percent)
than the second ranked malicious code family in 2012,
Sality (7.6 percent).
First discovered in 2010, W32.Ramnit has been a prominent
feature of the threat landscape since then, often switching
places with Sality throughout the year as the two families
jockey for first position.
Ramnit spreads by encrypting and then appending itself
to DLL, EXE, and HTML files. It can also spread by copying
itself to the recycle bin on removable drives and creating
an AUTORUN.INF file so that the malware is potentially
automatically executed on other computers. This can occur
when an infected USB device is attached to a computer. The
reliable simplicity of spreading via USB devices and other
media makes malicious code families such as Ramnit, and
Sality (as well as SillyFDC and others) effective vehicles for
installing additional malicious code on computers.
• The Sality family of malware, ranked second, remains
attractive to attackers because it uses polymorphic
code that can hamper detection. Sality is also capable
of disabling security services on affected computers.
These two factors may lead to a higher rate of successful
installations for attackers. Sality propagates by infecting
executable files and copying itself to removable drives such
as USB devices. Similar to Ramnit, Sality also relies on
AUTORUN.INF functionality to potentially execute when
those drives are accessed.
• Downadup gains a bit of momentum: Downadup (a.k.a.
Conficker) was ranked in third position in 2012, compared
with 2011 when it was ranked fourth-most malicious code
family by volume of potential infections in 2011. Downadup
propagates by exploiting vulnerabilities in order to copy
itself to network shares. Downadup was estimated to have
infected slightly more than 2 million PCs worldwide at the
end of 2012, 1 compared with approximately 3 million at the
end of 2011.
• Overall in 2012, 1 in 281.8 emails was identified as
malicious, compared with 1 in 238.8 in 2011; 22.5 percent
of email-borne malware comprised hyperlinks that
referenced malicious code, in contrast with malware that
was contained in an attachment to the email. This figure
was 39.1 percent in 2010, an indication that cybercriminals
are attempting to circumvent security countermeasures
by changing the vector of attacks from purely email to the
Web.
• In 2012, 12.6 percent of malicious code detected was
identified and blocked using generic detection technology.
Many new viruses and Trojans are based on earlier versions,
where code has been copied or altered to create a new strain,
or variant. Often these variants are created using toolkits
and hundreds of thousands of variants can be created from
the same piece of malware. This has become a popular
tactic to evade signature-based detection, as each variant
would traditionally need its own signature to be correctly
identified and blocked. By deploying techniques, such as
heuristic analysis and generic detection, it’s possible to
correctly identify and block several variants of the same
malware families, as well as identify new forms of malicious
code that seek to exploit certain vulnerabilities that can be
identified generically.
• Exploit/SpoofBBB was the most frequently blocked
malware in email traffic by Symantec.cloud in 2012, with
Trojan.Bredolab taking the second position.
• Trojan.JS.Iframe.AOX was the most frequently blocked
malicious activity in Web traffic filtered by Symantec.cloud
in 2012. Detection for a malicious IFRAME is triggered in
HTML files that contain hidden IFRAME elements with
JavaScript code that attempts to perform malicious actions
on the computer; for example, when visiting a malicious
Web page, the code attempts to quietly direct the user to a
malicious URL while the current page is loading.
• Stuxnet in 2012: Despite being developed for a very specific
type of target, the number of reports of potential Stuxnet
infections observed by Symantec in 2012 placed the
worm at a rank beyond 30 among malicious code families,
compared with 18 in 2011. The Stuxnet worm generated
a significant amount of attention in 2010 because it was
the first malicious code designed specifically to attack
Programmable Logic Controller (PLC) industry control
systems. 2 Notably, Stuxnet was the first malicious code
family that may directly affect the physical world and
proves the feasibility for malicious code to cause potentially
dramatic physical destruction.