internet security tHreAt rePOrt GOVernMent 2013

p. 141
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
VULNERABILITy TRENDS
Service Vulnerability (BID 10127 4 ), dating from April 2004,
and the Microsoft Windows RPC Service Denial of Service
Vulnerability (BID 6005 5 ), from October 2002.
• Finally, the fifth most exploited vulnerability is the
Microsoft Windows RPCSS Multi-thread Race Condition
Vulnerability (BID 8811 6 ), reported in October 2003.
• All of the top five vulnerabilities are several years old
with patches available: So why are they used so often even
several years after patches are available? There could be
several reasons why this is the case:
• Trading of vulnerabilities 7 either through legitimate or
clandestine channels has given exploitable vulnerabilities
a significant monetary value. Because of the restricted
information available on some of these new vulnerabilities,
criminals may not be able to take advantage of them unless
they are willing to pay the often substantial asking prices.
If they are unable or unwilling to pay, they may resort to
existing, widely available, tried-and-tested vulnerabilities
to achieve their goals, even if it may potentially be less
effective.
• For those willing to pay, they will want to ensure maximum
return on their investment. This could mean they will use it
discretely and selectively rather than making a big splash
and arousing the attention of security vendors and other
criminal groups looking for new vulnerabilities to use.
• Older vulnerabilities have a more established malware
user base and so account for a greater amount of traffic.
For example, widespread and well-established malware
threats, such as W32.Downadup 8 and its variants, use the
Microsoft Windows Server Service RPC Handling Remote
Code Execution Vulnerability (BID 31874), which continues
to register over 150,000 hits each day. Because these threats
use vulnerabilities to spread in an automated fashion, the
number of attacks they can launch would generally be far
higher than for targeted attacks.
• For various reasons, not all of the user population applies
security patches quickly or at all. This means older
vulnerabilities can often still be effective, even years after
patches are available. Because of this, there will always a
window of opportunity for criminals to exploit and they are
all too aware of this.
• File-based vulnerabilities: The most commonly exploited
data file format is the PDF file format. One of the PDF
related vulnerabilities, Adobe Acrobat, Adobe Reader, and
Adobe Flash Player Remote Code Execution Vulnerability
(BID 35759 9 ) registered as the fifth most often used
vulnerability in 2011 with just over 1 million attacks
reported. PDF files containing vulnerabilities are often
associated with Advanced Persistent Threat (APT 10 ) style
attacks, rather than self-replicating malware. However,
in this particular case, the vulnerability in question was
most often used in Web toolkit-based attacks. This attack
scenario involves creating malicious websites to host
exploit code. Users may then be tricked into visiting these
malicious toolkit websites either by website redirection (for
example, malicious IFRAMEs), SEO poisoning or by sending
out spam emails, instant messages or social media updates
with links to the malicious website. More information
on Web browser vulnerabilities can be found later in this
report.
• One thing to note, websites hosting malicious toolkits often
contain multiple exploits that can be tried against the
visitor. In some cases, the kit will attempt to use all exploits
at its disposal in a non-intelligent fashion whereas in more
modern advanced kits, the website code will attempt to
fingerprint the software installed on the computer before
deciding which exploit(s) to send to maximize the success
rate. The fact that there are so many Web-kit-based exploit
attempts made using this old vulnerability may suggest that
a considerable number of users have not updated their PDF
readers to a non-vulnerable version.