syssec_red_book

22. ENISA Threat Landscape2. Malware. Trojans are the most reported class of malware (also on mobiledevices). Trojan Autorun and Conficker worm are still two of the topthreats worldwide. Today, money making (e.g., through banking credentialstealing) is the main motivation behind malware campaigns. WithKoobface, the miscreant have showed that social networks are an effectivedistribution channel.3. Code Injection Attacks. SQL injection attacks are today more popular thancross-site scripting attacks than in the past. Hacktivists rely on SQLinjection attacks against their target websites.4. Exploit Kits. Malware-as-a-Service (MaaS) is a new and growing criminalbusiness. Modern criminals have a professional attitude, with supportand development services. The enabling “technologies” of MaaS are(1) exploit kits (packages that automate cybercrime) and a (2) plethoraof channels to deliver malware (malicious advertising, social networks,legitimate websites, malicious SEO).5. Botnets Within the MaaS phenomenon, botnets have become a commoditysince they switched from single-purpose (e.g., spamming, DDoS) to multipurposebotnets. For increasing the reliability of botnets, cybercriminalsrely on decentralized by peer-to-peer technologies (ZeroAccess botnets)and expand their surface to include mobile devices infected with specificmalware ported from desktop-based OSs.6. Compromising Confidential Information. 2011 has been addressed to asthe “year of security breaches.” Many sensitive database have beenleaked or targeted by attacks (e.g., healthcare, law enforcement). Accordingto the report, 9 out of 10 breaches would have been preventedthrough proper data protection and information security best practices.Indeed, besides targeted attacks, negligent, non-hostile insiders and webapplication vulnerabilities were the main cause of such breaches.7. Targeted Attacks have been increasing during the first half of 2012, withspear-phishing as the topmost common infection vectors against industrialcontrolsystems. Other tools used in targeted attacks include platformspecificmalware: Stuxnet, Duqu, and Flamer.8. Physical Theft/Loss/Damage. With the increased mobility of working locationsand with the bring-your-own-device practice, the probability of dataloss (even due to simple physical device theft) have increased in the lastyear. Unfortunately, the report highlights that full-device encryption isnot widely adopted, although this would be a good mitigation technique.132