|
Top Spam Categories
The most common type of spam detected in the first half of 2007 was related to commercial products, which made up 27% of all spam detected by sensors -- an increase from the 22% detected in the previous period. Commercial product spam usually consists of advertisements for commercial goods and services. It is frequently used to sell designer goods, such as watches, handbags and sunglasses, the profits from which can be substantial, given that the goods sold are often cheaply made counterfeits.
Full Chart 
Use of Automated Phishing Toolkits
A phishing toolkit is a set of scripts that allows an attacker to automatically set up phishing Web sites that spoof the legitimate Web sites of different brands, including the images and logos associated with those brands. Three phishing toolkits were responsible for 26% of all phishing attacks observed in the second half of 2007. This is a decrease from the first half of 2007, when three phishing toolkits were responsible for 42% of all phishing attacks.
Full Chart
Phishing Web Site Hosts
Between July 1, 2007 and Dec. 31, 2007, 87,963 phishing hosts were observed. This is an increase of 167% from the first half of 2007, when only 32,939 phishing Web site hosts were detected. Between the second half of 2006, when 13,353 phishing Web site hosts were detected, and the second half of 2007, a dramatic increase of 559% in phishing Web site hosts was observed.
Full Chart
Phishing Site Top-level Domains
The most common top-level domain (TLD) used in phishing Web sites between Jul. 1 and Dec. 31 of 2007 was ".com," accounting for 44% of the total. This is not surprising for a number of reasons. Phishers not only benefit from its familiarity, but since it is the most common TLD overall, it is natural that it is also the most commonly used TLD for phishing Web sites. The ".com" domain is also unrestricted and is available to anyone who wishes to register a ".com" domain name, making it easy for phishers to register these domains.
Full Chart
Top Countries Hosting Phishing Web Sites and Top Targets Phished
In the second half of 2007, 66% of all phishing attacks detected were associated with Web sites located in the United States. For phishing attacks with Web sites hosted in the United States, all of the top 10 targets are also headquartered there. The top target phished on Web sites hosted in the United States was a social networking site. Together with another social networking site, these two sites accounted for 91% of phishing attacks with Web sites hosted in the United States.
Full Chart
Phished Sectors by Volume of Phishing Web Sites
The drop in volume of phishing Web sites targeting financial organizations during the period is worth noting. The drop is potentially driven by the increased knowledge and awareness of phishing schemes and how to avoid falling victim to them. Information campaigns driven by financial institutions, as well as warning emails and a general heightened awareness of phishing schemes targeting financial services, have likely made it more difficult for phishers to carry out successful phishing attacks against them.
Full Chart
Unique Brands Phished by Sector
The majority of brands used in phishing attacks in the last six months of 2007 were in the financial services sector, accounting for 80%, virtually unchanged from the 79% reported in the previous period. The financial services sector also accounted for the highest volume of phishing Web sites during this period, at 66%, down from 72% in the first half of 2007.
Full Chart
Malicious Code That Exploits Vulnerabilities
During the second half of 2007, 10% of the 1,032 documented malicious code instances exploited vulnerabilities. This is lower than the 18% proportion of the 1,509 malicious code instances documented in the first half of 2007. While the number of new samples exploiting vulnerabilities declined in the current reporting period, this method of propagation remains effective.
Full Chart
Malicious Code That Modifies Web Pages
In the last six months of 2007, 7% of the top 50 malicious code samples modified Web pages -- up from 3% in the first half of the year. In the second half of 2006, none of the top 50 malicious code samples attempted to modify Web pages on the compromised computer. It is likely that the success of threats like the MPack kit has encouraged attackers, in recent months, to use Web pages to install malicious code.
Full Chart
Threats to Confidential Information by Type
In this reporting period, 86% of confidential information threats had a remote access component, compared to 88% in the first half of 2007 and 87% in the last half of 2006. While this exposure type dropped slightly in the current period, it still remains more popular than other techniques. This is likely because remote access, such as a back door, gives the attacker extensive control over the compromised computer, allowing for the theft of any information on the computer, the installation of other threats or the use of the computer for other purposes, such as relaying spam or hosting a phishing Web site.
Full Chart
Threats to Confidential Information by Volume
In the last six months of 2007, threats to confidential information made up 68% of the volume of the top 50 malicious code samples causing potential infections. This is an increase over the 65% reported in the first half of 2007 and the 53% from the same period in 2006. Malicious code can expose confidential information in a variety of ways. The most common method is by allowing remote access to the compromised computer through a back door.
Full Chart
Malicious Code Types by Potential Infections
During the current reporting period, Trojans made up 71% of the volume of the top 50 potential malicious code infections -- a slight decrease from 73% in the first half of 2007 but still more than the 60% in the same period of 2006. It is interesting to note that, while the volume of Trojans in the top 50 decreased only slightly since the first half of the year, the number of distinct Trojans in the top 50 decreased from 22 in the first half of the year to 16 in the last six months of 2007.
Full Chart
Top 10 New Malicious Code Families
Of the top 10 new malicious code families detected in the last six months of 2007, five were Trojans, two were worms, two were worms with a back door component and one was a worm with a virus component. The prevalence of Trojans in the top new malicious code families is indicative of multistage attacks. These are attacks in which an initial compromise takes place in order to install another piece of malicious code, such as a Trojan, that then downloads and installs additional threats.
Full Chart
New Malicious Code Threats
In the last six months of 2007, 499,811 new malicious code threats were detected. This is a 136% increase over the previous period, when 212,101 new threats were detected, and a 571% increase over the last half of 2006. In total, there were 711,912 new threats detected in 2007 compared to 125,243 threats in 2006 -- an increase of 468%. This brings the overall number of malicious code threats identified to 1,122,311, as of the end of 2007. This means that almost two-thirds of all malicious code threats currently detected were created during 2007.
Full Chart
Vulnerabilities in Security Products
During the second half of 2007, 92 vulnerabilities that affected security products were detected. Of these, 15 were classified as high severity, 48 as medium and 29 as low. This is fewer than the 113 vulnerabilities that affected security products during the first half of 2007, of which 23 were classified as high severity, 58 as medium and 32 as low. During the last six months of 2007, 4% of all vulnerabilities documented during the period affected security products, down slightly from 5% during the first six months of the year.
Full Chart
Unpatched Vulnerabilities, by Vendor
In the second half of 2007, 88 unpatched enterprise vulnerabilities were detected as being published during this period. Of these, 39 affected Microsoft, 22 affected IBM, 10 affected Computer Associates, eight affected HP, five affected Sun, three affected Oracle and one affected Symantec. No other vendor was subject to unpatched vulnerabilities during this period.
Full Chart
Site-specific Cross-site Scripting Vulnerabilities Time to Patch, in Days
Site-specific vulnerabilities are a growing concern. The number of cross-site scripting vulnerabilities that affected specific sites in 2007 exceeds the total number of traditional vulnerabilities tracked. Moreover, the numbers presented in this section are also only representative of site-specific vulnerabilities that are reported voluntarily by security researchers to the XSSed Project archive. Other types of Web-application vulnerabilities are not covered.
Full Chart
Site-specific Cross-site Scripting Vulnerabilities
During the last six months of 2007, there were 11,253 site-specific cross-site scripting vulnerabilities that were documented by the XSSed project. At the time of writing, only 473 of these vulnerabilities had been fixed by the maintainer of the affected Web site. In the first six months of 2007, the total was 6,961, although data collection only began in February, which factors into the lower total. Of the 6,961, only 330 had been fixed at the time of writing.
Full Chart
Web Application Vulnerabilities
In the second half of 2007, 58% of all vulnerabilities affected Web applications. This is less than the 61% in the first half of 2007. This drop in the proportion of Web application vulnerabilities is a continuing trend. From an attacker's standpoint, rather than try to compromise numerous smaller sites, it is better to compromise a specific popular site with a single vulnerability, as this increases the chances of compromising a larger number of hosts.
Full Chart
Browser Plug-in Vulnerabilities
Browser plug-in vulnerabilities continue to be prevalent because technologies such as ActiveX remain an easy target for security researchers and attackers alike, mostly due to fuzzer programs such as AxMan79 and COMRaider. This may indicate that there is a lack of secure development practices among ActiveX application developers. However, ActiveX is also an attractive target because many users may not be aware that they have installed vulnerable controls, and because of the relative difficulty of removing or patching ActiveX controls once they have been installed.
Full Chart
Web Browser Vulnerabilities
During the second half of 2007, 88 vulnerabilities affected Mozilla browsers. Of these, 19 were considered to be medium severity and 69 were considered low. This total is an increase from the 34 vulnerabilities that affected Mozilla browsers in the first half of 2007. Of those, 12 were considered medium severity and 22 were low. Safari was affected by 22 vulnerabilities in the second half of 2007. One was considered high severity, 12 were medium and nine were low. This is a decrease from the 25 Safari vulnerabilities that were documented in the first half of 2007, of which seven were medium severity and 18 were low.
Full Chart
Window of Exposure for Web Browsers
During the last six months of 2007, Mozilla had a window of exposure of three days based on a sample set of 82 patched vulnerabilities. This is a decrease from the window of exposure of five days in the first half of 2007, which was based on 22 patched vulnerabilities. In the second half of 2007, Microsoft Internet Explorer had a window of exposure of 11 days based on a sample set of 11 patched vulnerabilities. This is an increase from the five-day time period in the first half of 2007, which was based on a sample set of 17 patched vulnerabilities.
Full Chart
Operating System Time to Patch by Type of Vulnerability
Of the 86 patched vulnerabilities that affected Apple Mac OS X in the second half of 2007, eight affected browsers, 31 were client-side vulnerabilities, 15 were local, 15 affected servers and 17 did not fall into any of these categories. From the sample set of 21 vulnerabilities for HP in the last six months of 2007, 11 affected browsers, four were client-side vulnerabilities, three affected servers and three did not fit in any category. Meanwhile, 22 patched vulnerabilities in Microsoft Windows were categorized. Seven of these affected browsers, 11 were client-side vulnerabilities, one was local and three affected servers.
Full Chart
Patch Development Time for Operating Systems
Of the five operating systems assessed in the last six months of 2007, Microsoft Windows had the shortest average patch development time of six days based on a sample set of 22 patched vulnerabilities. None of the vulnerabilities affected third-party applications. This is shorter than the average patch development time of 18 days in the first six months of 2007, based on a sample set of 38 vulnerabilities, including two vulnerabilities that affected third-party applications.
Full Chart
Bot Command-and-Control Servers
In the last six months of 2007, 4,091 bot command-and-control servers were identified. This is an 11% decrease from the previous reporting period, when 4,622 bot command-and-control servers were identified. The decrease in the number of bot command-and-control servers detected reflects the growing trend in the methods botnet owners are using to communicate with their bot-infected computers.
Full Chart
Active Bot-Infected Computers by Day
Between July 1 and December 31, 2007, an average 61,940 active bot-infected computers were observed each day, a 17% increase from the previous reporting period. An active bot-infected computer is one that carries out an average of at least one attack per day. This does not have to be continuous; rather, a single computer can be active on a number of different days. During this period 5,060,187 distinct bot-infected computers were observed, only a one percentage point increase from the first six months of 2007. A distinct bot-infected computer is a distinct computer that was active at least once during the period.
Full Chart
Data Breaches That Could Lead to Identity Theft by Cause and Identities Exposed
In the second half of 2007, the primary cause of data breaches that could facilitate identity theft was the theft or loss of a computer or other medium on which data is stored or transmitted, such as a USB key or a backup medium. Theft or loss made up 57% of all data breaches during the second half of 2007 and accounted for 46% of all reported breaches in the previous reporting period.
Full Chart
Data Breaches that Could Lead to Identity Theft by Sector and Identities Exposed
In the second half of 2007, the education sector represented the highest number of known data breaches that could lead to identity theft, accounting for 24% of the total. This is a decrease from the previous reporting period when the education sector accounted for 30% of the total, when it also ranked first. Educational institutions store a large amount of personal information on students, faculty and staff that could be used for the purposes of identity theft, including government-issued identification numbers, names, addresses and birth dates.
Full Chart
Use of Automated Phishing Toolkits
A phishing toolkit is a set of scripts that allows an attacker to automatically set up phishing Web sites that spoof the legitimate Web sites of different brands, including the images and logos associated with those brands. A look at the three most widely used phishing toolkits reveals that, on average, they alone were responsible for 42% of all phishing attacks detected in the first half of 2007. This shows the high percentage of complete automation used in phishing attacks compared to attacks that are only partially automated. Automation allows attackers to send a high volume of phishing messages that spoof several brands to a large number of recipients with minimal effort.
Full Chart
Image Spam as a Percentage of All Spam
During the first half of 2007, 27% of all spam blocked consisted of image spam. While image spam started at a higher level at the beginning of the period, reaching nearly 50% of all spam in the first week of January, it showed a marked decline beginning in April and continuing throughout May. The January level is likely due in large part to the rise of the Peacomm Trojan, which sent image spam. While the decline of image spam subsided in June, it did not regain the prominence it achieved at the beginning of the period.
Full Chart
Top Countries of Spam Origin
During the first six months of 2007, 47% of all spam detected worldwide originated in the United States. This is likely due to the high number of broadband users in that country and the high percentage of bot-infected computers located there. The United States was also the top country of spam origin in the second half of 2006, when 44% of spam originated there. The second-highest source of spam this period was a group of undetermined European Union countries, from where 7% of all detected spam originated during this period. China was the third-highest country of spam origin in the first half of 2007.
Full Chart
Top Spam Categories
The most common type of spam detected in the first half of 2007 was related to commercial products, which made up 22 % of all spam detected during this period. This is a slight increase from the previous period when this category made up 21 % of detected spam. Commercial product spam usually consists of advertisements for commercial goods and services. It is frequently used to sell designer goods, such as watches, handbags and sunglasses. There is financial motivation since the goods sold are often counterfeit and can be sold at a profit. Spam related to financial services made up 21 % of all spam in the first six months of 2007, making it the second most common type of spam during this period.
Full Chart
Malicious Code Types by Volume
During the first half of 2007, Trojans made up 54 % of the volume of the top 50 malicious code reports, an increase over the 45 % reported in the final six months of 2006. While part of this increase can be attributed to the success of the Peacomm Trojan, there were also a wide variety of other Trojans present in the top 50 malicious code reports. As previously mentioned, Trojans are likely gaining prominence because they generate a low volume of traffic compared to network and mass-mailing worms.
Full Chart
Browser Plug-in Vulnerabilities
In the first half of 2007, 237 vulnerabilities affecting browser plug-ins were documented. Of these, 210 affected ActiveX components, 18 affected the Apple QuickTime plug-in, four affected the Sun Java plug-in, three affected extensions for Mozilla browsers and two affected the Adobe Acrobat plug-in. Adobe Flash, Microsoft Windows Media Player and Opera widgets were not affected by any browser plug-in vulnerabilities during this period.
Full Chart
Zero-Day Vulnerabilities
Of the zero-day vulnerabilities documented during the first half of 2007, three of the vulnerabilities affected Microsoft Office applications. This is a drop from the six zero-day vulnerabilities that affected Office in the second half of 2006. The number of zero-day Office vulnerabilities may have dropped due to measures taken by Microsoft to patch as many pending Office vulnerabilities as possible.
Full Chart
Web Browser Vulnerabilities
During the first six months of 2007, 39 vulnerabilities were documented in Microsoft Internet Explorer. Of these, one was considered to be high severity, 15 were medium severity and 23 were low. During the same time period, 34 vulnerabilities were disclosed that affected Mozilla browsers. Of these, 12 were considered to be medium severity and 22 were considered low.
Full Chart
Web Application Vulnerabilities
In the first half of 2007, 61% of all vulnerabilities affected Web applications. This is a drop from the 66% reported in the second half of 2006, and a further decrease from the 69% of all vulnerabilities that affected Web applications in the first half of 2006.
Full Chart
Patched Operating System Vulnerability by Type
Of the 59 patched vulnerabilities that affected Apple Mac OS X in the first half of 2007, eight affected browsers, 21 were client-side vulnerabilities, 17 were local, 11 affected servers and two vulnerabilities did not fit into any of these categories. There were 30 patched vulnerabilities disclosed during this period that affected HP-UX. Of these, 13 affected browsers, three were client-side, three were local, nine affected servers and two could not be categorized.
Full Chart
Patch Development Time for Operating Systems
Of the five operating systems tracked in the first six months of 2007, Microsoft had the shortest average patch development time at 18 days, based on a sample set of 38 patched vulnerabilities. Of the 38 vulnerabilities, two affected third-party applications. This is lower than the average patch development time of 23 days in the second half of 2006 based on a sample set of 50 vulnerabilities, seven of which affected third-party applications.
Full Chart
Bot-Infected Computers by Country
China had the highest number of bot-infected computers during the first half of 2007, accounting for 29% of the worldwide total. This is a slight increase from 26% in the second half of 2006, when China also had the highest number of bot-infected computers.
Full Chart
Command-and-Control Servers
In the first six months of 2007, 4,622 bot command-and-control servers were identified. This is a 3% decrease from the previous period, when 4,746 command-and-control servers were identified. The decrease in command-and-control servers reflects a consolidation of bot networks observed in second half of 2006. During that period, the number of command-and-control servers decreased and the average size of bot networks increased.
Full Chart
Average Lifespan of Bot-Infected Computers
During the first six months of 2007, the lifespan of the average bot-infected computer was four days. This is an increase from the previous period, when the average lifespan was three days. The median lifespan of a bot-infected computer during both periods was one day. This indicates that the majority of bot-infected computers only participate in attacking behavior for a short period, after which they are either identified and disinfected, or are used for activities other than carrying out Internet attacks, such as hosting spam zombies or phishing Web sites.
Full Chart
Active Bot-Infected Computers per Day
Between January 1 and June 30, 2007, an average of 52,771 active bot-infected computers were observed per day, a 17% decrease from the previous reporting period. The decrease in bots observed over the past six months is likely due to a number of reasons, the primary one being a change in bot attack methods. The exploitation of network-based vulnerabilities to spread bots is being slowly abandoned for methods that are more likely to succeed, such as bots that send a mass mailing of themselves.
Full Chart
Breakdown of Goods Available for Sale on Underground Economy Servers
During the first half of 2007, credit cards were the most frequently advertised item, making up 22% of all goods available for sale on underground economy servers. Bank account credentials, including account numbers and authentication information, were the second most commonly advertised item on underground economy servers during the period, accounting for 21% of all advertised goods. The advertised price for bank account credentials varied widely, ranging between $30 and $400 USD, and was dependent on the funds available in the account.
Full Chart
Location of Banks Whose Cards Were Sold on Underground Economy Servers
During the first six months of 2007, 85% of credit and debit cards advertised for sale on underground economy servers were issued by banks in the United States. This is down slightly from 86% in the last six months of 2006.
Full Chart
Location of Underground Economy Servers
During the first six months of 2007, 64% of all underground economy servers identified were located in the United States, by far the highest total of any country. During the last half of 2006, the United States was home to the majority of underground economy servers as well, accounting for 51% of the total. Germany had the second most underground economy servers during the first half of 2007, accounting for 12% of the worldwide total.
Full Chart
Number of Identities Exposed by Cause
In the first half of 2007, hacking was responsible for 73% of identities exposed. The prominence of hacking as a cause of exposed identities was largely driven by the TJX breach. This shows clearly that hacking is the cause of data breaches that is most likely to lead to wide-scale identity theft. This is likely because hacking is more clearly purpose-driven than insecure policy or the loss or theft of devices. It is an intentional act with a clearly defined purpose: to steal data that can be used for purposes of identity theft or other fraud.
Full Chart
Data Breaches that Could Lead to Identity Theft by Cause
In the first half of 2007, the primary cause of data breaches that could facilitate identity theft was the theft or loss of a computer or other medium on which data is stored or transmitted, such as a USB key or a back-up medium. These made up 46% of all such data breaches during this period. Theft or loss accounted for 57% of all reported breaches in the previous reporting period. Despite this, theft or loss of a computers and storage media only accounted for 11% of all identities exposed.
Full Chart
Identities Exposed by Sector
During the first half of 2007, the retail/wholesale sector accounted for only 6% of all data breaches that could lead to identity theft, making it the fifth ranked sector during this period. However, the sector was responsible for the largest number of exposed identities, accounting for 85%. Breaches in this sector were thus far more likely to result in wide-scale identity theft than any other sector. Each data breach would facilitate identity theft to a much greater degree.
Full Chart
Data Breaches that Could Lead to Identity Theft by Sector
In the first half of 2007, the education sector accounted for 30% of all known data breaches that could lead to identity theft, more than any other sector. This is up from the previous period when education accounted for only 22% of the total and was the second ranked sector. In spite of the high number of data breaches that occurred in the education sector during the first six months of 2007, it only accounted for 1% of all identities exposed during the period. This is likely because most data breaches within the education sector were caused by theft or loss of computers or data-storage devices.
Full Chart
Malicious Activity Originating from Fortune 100 Companies
Between January 1 and June 30, 2007, 4% of malicious activity detected originated from the IP address space of Fortune 100 companies. The IP space of Fortune 100 organizations constitutes just over 7% of the world's active and advertised IP space. Since the proportion of malicious activity originating from Fortune 100 IP space is lower than the proportion of the world's active and advertised IP space that is assigned to these organizations, less attack activity is originating from Fortune 100 companies than other IP spaces. It is likely that security measures put in place on Fortune 100 networks make it difficult for attackers to compromise them, or to use them to launch attack activity.
Full Chart
Malicious Activity by Country per Internet User
During the first six months of 2007, Israel was the most highly ranked country for malicious activity per Internet user. If one person from each of the top 25 countries were assessed as a representation of their country's Internet users, the average user in Israel would carry out 11% of the group's malicious activity. This is a small increase from 9% in the previous period.
Full Chart
Malicious Activity by Country
Between January 1 and June 30, 2007, the United States was the top country for malicious activity, making up 30% of worldwide malicious activity. This represents a minimal change from the second half of 2006, when the United States was also the highest ranked country, accounting for 31% of the world's malicious activity. For each of the malicious activities taken into account for this measurement, the United States ranked number one by a large margin with the exception of bot-infected computers. It ranked second for that criteria behind only China.
Full Chart
Threats to Confidential Information by Type
In the first half of 2007, 237 vulnerabilities affecting browser plug-ins were detected. Of these, 210 affected ActiveX components, 18 affected the Apple QuickTime® plug-in, four affected the Sun™ Java™ browser plug-in, three affected extensions for Mozilla browsers and two affected the Adobe Acrobat plug-in. Adobe Flash, Microsoft Windows Media Player and Opera widgets were not affected by any browser plug-in vulnerabilities during this period.
Full Chart
Browser Plug-In Vulnerabilities
In the first half of 2007, 237 vulnerabilities affecting browser plug-ins were detected. Of these, 210 affected ActiveX components, 18 affected the Apple QuickTime® plug-in, four affected the Sun™ Java™ browser plug-in, three affected extensions for Mozilla browsers and two affected the Adobe® Acrobat® plug-in. Adobe® Flash®, Microsoft Windows Media Player and Opera widgets were not affected by any browser plug-in vulnerabilities during this period.
Full Chart
Bot-Infected Computers by Country
China had the highest number of bot-infected computers during the first half of 2007, accounting for 29% of the worldwide total, up from 26% in the second half of 2006. This continues a trend that was first discussed in the first half of 2005, which saw an increase in bot activity in China during that period.
Full Chart
Active Bot-Infected Computers per Day
An active bot-infected computer is one that carries out at least one attack per day. This does not have to be continuous; rather, a single computer can be active on a number of different days. Between January 1 and June 30, 2007, an average of 52,771 active bot-infected computers per day were observed, a 17% decrease from the previous reporting period.
Full Chart
Breakdown of Goods Available for Sale on Underground Economy Servers
During the first six months of 2007, 8,011 distinct credit cards were observed being advertised for exchange on underground economy servers. This is only a small proportion of the credit cards sold, however. Typically, users selling credit card information advertise bulk rates and merely give examples of credit card information to attract buyers. Common bulk amounts and rates seen during the first six months of 2007 were: 10 credit card numbers for $20 USD; 50 credit card numbers for $70 USD; and 100 credit card numbers for $100 USD.
Full Chart
Data Breaches that Could Lead to Identity Theft by Sector
In the first half of 2007, the education sector accounted for more data breaches that could lead to identity theft than any other sector, making up 30% of the total. This is up from the previous period when the education sector accounted for only 22% of the total and ranked second. The retail/wholesale sector accounted for only 6% of all data breaches, making it the fifth ranked sector during this period. However, the sector was responsible for the largest number of exposed identities, accounting for 85%.
Full Chart
Malicious Code that Exploits Vulnerabilities
In the second half of 2006, five zero-day exploits were released for vulnerabilities in Microsoft Office. This accounts for a significant proportion of malicious code that exploits vulnerabilities during the second half of 2006. Zero-day vulnerabilities present attackers with an opportunity to evade detection when compromising computers. In the context of malicious code, this will also increase the success rate when compromising computers, as the malicious code will appear to spread through an unknown vector until it has been discovered, analyzed and mitigated by security and antivirus vendors.
Full Chart
Propagation Mechanisms
While malicious code propagating over SMTP decreased during this period, all other vectors experienced an increase. This is likely the result of an effort by attackers to diversify the way their threats proliferate. Good email scanning applications and increased user knowledge of mass-mailing threats have reduced the effectiveness of email as a propagation mechanism. As a result, some attackers are resorting to other propagation mechanisms or incorporating additional propagation mechanisms into a mass-mailing worm.
Full Chart
Threats to Confidential Information by Source, July-December 2006
While the volume of threats that allow remote access has decreased, the volume of threats that log keystrokes and export user and system data have all increased. Keystroke logging threats made up 79% of confidential information threats by volume of reports in the second half of 2006, up from 57% in the first half of the year and 66% in the second half of 2005. During the current reporting period, keystroke loggers made up 76% of confidential information threats by infection. A keystroke logger will record keystrokes on the compromised computer. It usually either emails the log to the attacker or uploads it to a Web site that is under the attacker's control. This makes it easier for an attacker to gather confidential information from a large number of compromised computers with minimal effort.
Full Chart
Threats to Confidential Information by Type
In the second half of 2006, threats that allow remote access, such as back doors, made up 84% of confidential information threats by volume of reports, the same as in the first half of the year, but a decrease from 90% in the second half of 2005. During this reporting period, threats that allow remote access made up 87% of threats by potential infection. While a threat that allows remote access, such as a back door, could give an attacker full access to a computer, the attacker must typically access it manually. This likely explains why the numbers of reports (84%) are similar to the number of potential infections during this reporting period (87%).
Full Chart
Threats to Confidential Information by Volume
In the last six months of 2006, threats to confidential information made up 66% of the volume of top 50 malicious code programs reported. This is an increase over the 48% reported in the first half of the year and the 55% reported during the second half of 2005. Malicious code can expose confidential information in a variety of ways. The most common method is by allowing remote access to the compromised computer through a back door. In this method, the attacker typically uses a specialized application to connect to the compromised computer and performs numerous actions such as taking screenshots, changing configuration settings, and uploading, downloading or deleting files.
Full Chart
Malicious Code Types by Source, July-December 2006
While worms made up 52% of malicious code reports in the second half of 2006, they caused only 37% of potential infections. The main reason for this is that mass-mailing worms generate a significant number of email messages to which they attach their malicious code. Each message that is detected will generate a malicious code report. Because of the high volume of email that one worm can generate, a single infection can result in many reports. However, once a malicious code sample is detected, antivirus signatures are quickly developed that can protect against subsequent potential infections by that sample. So, only a small percentage of the high volume of email messages will result in additional infections.
Full Chart
Malicious Code Types by Volume
During the current reporting period, worms made up 52% of the volume of the top 50 malicious code reports, down from 75% in the previous period. This drop can largely be attributed to the decline in reports of major worms such as Sober.X,73 Blackmal.E,74, and Netsky.P75 since the first half of 2006. The longer a threat has been in the wild, the more time users will have had to update their detection signatures. The volume of these worms has likely declined because users have installed antivirus definitions that detect them.
Full Chart
Top Ten New Malicious Code Families
Of the top ten new malicious code families detected in the last six months of 2006, five were Trojans, four were worms, and one was a virus. One of the Trojans also had back door capabilities. This indicates that attackers may be moving toward using Trojans as a means of installing malicious code on computers. As Trojans do not propagate, they allow attackers to perform targeted attacks without drawing attention to themselves. The longer a threat remains undiscovered in the wild, the more opportunity it has to compromise computers before measures can be taken to protect against it.
Full Chart
Database Vulnerabilities
In the second half of 2006, 168 vulnerabilities were documented that affected Oracle databases. This is a slight decrease from the 169 vulnerabilities disclosed in the first half of 2006 and an increase over the 131 in the second half of 2005. During the second half of 2006, five vulnerabilities were documented in IBM DB2 databases. This is a slight increase from the four vulnerabilities documented during the first half of 2006. Seven vulnerabilities affected IBM DB2 during the second half of 2005.
Full Chart
Zero-Day Vulnerabilities
A zero-day vulnerability is one for which there is sufficient public evidence to indicate that the vulnerability has been exploited in the wild prior to being publicly known. Zero-day vulnerabilities represent a serious threat in many cases because there is no patch available for them, and because they will likely be able to evade purely signature-based detection. A black market for zero-day vulnerabilities has emerged that has the potential to put them into the hands of criminals and other interested parties. In the second half of 2006, 12 zero-day vulnerabilities were documented. This is a significant increase compared to the first half of 2006 and the second half of 2005, when only one zero-day vulnerability was documented for each reporting period.
Full Chart
Web Browser Vulnerabilities
In the second half of 2006, 54 vulnerabilities in Microsoft Internet Explorer were documented. Of these, one was considered to be high severity, 13 were medium severity and 40 were classified as low severity. This total is an increase from the 38 vulnerabilities documented in the first half of 2006. During the second half of 2006, 40 vulnerabilities affected the Mozilla browsers. Of these, 35 were considered to be medium severity and five were considered low. During the second half of 2006, four vulnerabilities were disclosed that affected Opera.
Full Chart
Vendor Responsiveness
Vendor responsiveness is measured by the proportion of vulnerabilities that remains unconfirmed by the vendor and, therefore, unpatched over time.
Vendor responsiveness is an important security consideration because, in many cases, unsanctioned, unsupported and unmaintained software may be deployed within the organization. In the second half of 2006, 68% of documented vulnerabilities were not confirmed by the affected vendor. This is an increase from the first half of the year, when 61% of vulnerabilities were not confirmed by the vendor. In the second half of 2005, 55% of documented vulnerabilities were not vendor confirmed.
Full Chart
Patch Development Time for Operating Systems
Microsoft Windows had the shortest average patch development time of the five operating systems in the last six months of 2006. During this period, Windows had an average patch development time of 21 days based on a sample set of 39 patched vulnerabilities. This represents an increase over the first six months of 2006, when Windows had an average patch development time of 13 days based on a sample set of 22 vulnerabilities.
Full Chart
Command-and-Control Servers by Country
Command-and-control servers are computers that bot network owners use to relay commands and instructions to the bot-infected computers that make up their networks. Although China had the most bot-infected computers worldwide, it had only the fourth highest number of known command-and-control servers worldwide. This discrepancy likely indicates that the majority of bot-infected computers in China are being controlled from servers in other countries. For example, an attacker in the United States could control a command-and-control server in the United Kingdom to administer bot-infected computers all over the world.
Full Chart
Active bot-infected computers per day
Between July 1 and Dec. 31, 2006, an average of 63,912 active bot-infected computers were observed per day. This is an 11% increase from the previous period, when an average of 57,717 active bots were observed per day. Furthermore, 6,049,594 distinct bot-infected computers were observed during the current reporting period, a 29% increase from the previous period, when 4,696,903 distinct bot-instinct computers were identified.
Full Chart
Advertised prices of items traded on underground economy servers
Cards from the United States sold over underground economy servers are generally advertised for about half as much as those from the United Kingdom. For instance, credit cards from US-based banks have been advertised for $3.00 USD, while credit cards from UK-based banks are advertised for $6.00 USD. Other items are also being sold on underground economy servers, including full identities, which typically involve government-issued identification numbers (such as social security numbers), bank account information (including passwords), personal information (such as date of birth), as well as identity verification information (such as a person's mother's maiden name).
Full Chart
Location of Banks with Cards Sold on Underground Economy Servers
During the last six months of 2006, 4,943 credit cards were observed being traded on underground economy servers. By far, most of the credit and debit cards advertised for sale on underground economy servers were issued by banks in the United States. The prominence of the United States is not entirely unexpected. The vast majority of the identity theft-related data breaches reported during the last six months of 2006 took place in the United States.
Full Chart
Data Breaches that Could Lead to Identity Theft by Cause
In the second half of 2006, the primary cause of data breaches that could facilitate identity theft was theft or loss of a computer or other medium on which data is stored or transmitted, such as a USB key or backup medium. These made up 54% of all identity theft-related data breaches during this period. In many cases, the computers that were lost or stolen were laptop computers.
The second most common cause of data breaches that could lead to identity theft during this period was insecure policy, which made up 28% of all incidents.
Full Chart
Malicious Activity by Country per Internet User
Israel was the most highly ranked country for malicious activity per Internet user. If one person from each of the top 25 countries were assessed as a representation of their country's Internet users, the average user in Israel would carry out 9% of malicious activity. Taiwan ranked second, accounting for 8% of malicious activity per Internet user. Poland ranked third, accounting for 6%.
Full Chart
Malicious Activity by Country
Between July 1 and December 31, 2006, the United States was the top country for malicious activity, making up 31% of worldwide malicious activity. For each of the malicious activities taken into account for this measurement, the United States ranked number one by a large margin, with the exception of bot-infected computers. The United States ranked second for that criterion, 12 percentage points lower than China.
Full Chart
Bot-infected Computers by Country
China had the highest number of bot-infected computers during the second half of 2006, accounting for 26% of the worldwide total. This is an increase of six percentage points over the previous six months. This increase was driven by a rise in the number of bots in the country, rather than a decrease in other countries. This coincides with and illustrates a trend first discussed in 2005, in which bot activity in China appeared to be increasing. During the second half of 2006, the United States had the second highest number of bot-infected computers, accounting for 14% of the worldwide total.
Full Chart
Malicious code types, by reports and by potential infections, July -- December 2006
During the current reporting period, worms made up 52% of the volume of malicious code threats, down from 75% in the previous period. However, the number of unique samples of worms in the top 50 malicious code reports remained fairly constant over the last six months of 2006. During this period, 36 worms were reported, compared to 38 in the previous period. The volume of Trojans in the top 50 malicious code samples reported increased significantly in the last six months of 2006. During this period, they constituted 45% of the volume of the top 50 malicious code samples, a significant increase over the 23% last period and the 38% reported in the second half of 2005.
Full Chart
Location of Underground Economy Servers
Underground economy servers are used by criminals and criminal organizations to sell stolen information, typically for subsequent use in identity theft. This data can include government-issued identity numbers, credit cards, bank cards and personal identification numbers (PINs), user accounts and email address lists. During the second half of 2006, 51% of all underground economy servers were located in the United States, the highest total of any country. Sweden ranked second, accounting for 15% of the worldwide total, and Canada ranked third, accounting for 7%.
Full Chart
Data Breaches That Could Lead to Identity Theft by Sector
In the second half of 2006, the government sector accounted for the majority of data breaches that could lead to identity theft, making up 25% of the total. Government organizations store a lot of personal information that could be used for the purposes of identity theft. Furthermore, they often consist of numerous semi-independent departments. As a consequence, sensitive personal identification information may be stored in separate locations and be available to numerous people. This increases the opportunity for attackers to gain unauthorized access to this data. Governments may also be more likely to report such breaches than private organizations, which may fear negative market reaction.
Full Chart
Malicious Activity by Country
Between July 1 and Dec. 31, 2006, the United States was the top country for malicious activity, accounting for 31% of the worldwide total. For each of the malicious activities taken into account for this measurement, the United States ranked number one by a large margin with the exception of bot-infected computers. It ranked second for that criterion, 12 percentage points lower than China.
Full Chart
Window of Exposure, Enterprise Vendors
In the first six months of 2006, the average patch development time for enterprise vendors was 31 days. During the same period, the average exploit code development time for vulnerabilities affecting enterprise vendors was three days. As a result, the window of exposure for this reporting period was 28 days. In the second half of 2005, the window of exposure for vulnerabilities affecting enterprise vendors was 50 days, based on a patch development time of 57 days and an exploit code development time of seven days.
Full Chart
Operating System Patch Development Time
Over the past six months, each of the five vendors of operating systems had shorter average patch development times than in the previous two six-month periods. Linux vendor patch development times were generally shorter than those of the commercial UNIX vendors, HP and Sun. Over the past three reporting periods, Microsoft has had the shortest patch development time of all the operating system vendors. Along with Microsoft, Red Hat had the lowest patch-development time during this reporting period. This is likely related to open-source collaboration.
Full Chart
Easily Exploitable Vulnerabilities by Type
Over the first six months of 2006, 78% of easily exploitable vulnerabilities affected Web applications. This continued the increase that was evident in the two previous six-month periods, during which Web applications accounted for 69% and 61% of easily exploitable vulnerabilities, respectively. In part, Web applications dominate this metric because they make up the majority of vulnerabilities that were documented over the last three periods.
Full Chart
Web Application Vulnerabilities
Vulnerabilities affecting Web applications accounted for 69% of all vulnerabilities that were documented in the first half of 2006. This is a slight increase over the 68% seen in the second half of 2005. It is also higher than the 60% proportion in the first half of 2005. Web applications generally have quicker release cycles than traditional desktop and server applications. This provides security researchers with a continually growing source of new applications to audit, particularly as, in many cases, Web applications do not undergo the same degree of quality assurance and testing as other applications.
Full Chart
Total Volume of Vulnerabilities
During the first half of 2006, 2,249 new vulnerabilities were detected. This is an increase of 18% over the 1,912 vulnerabilities that were documented in the second half of 2005. It is also a 20% increase over the 1,874 vulnerabilities that were reported in the first half of 2005. A higher volume of vulnerabilities were documented in this reporting period than in any other previous six-month period. The marked increase in the number of vulnerabilities can be attributed to the continued growth in those that affect Web applications. This is due to the relative ease of discovering vulnerabilities in Web applications compared to other applications.
Full Chart
Top Targeted Sectors
Between January 1 and June 30, 2006, the home user sector was the most highly targeted sector, accounting for 86% of all targeted attacks. As computers in the home user sector are less likely to have well-established security measures and practices in place, they may be more vulnerable to targeted attacks. Furthermore, as home users represent a fertile resource for identity theft, it is likely that many of the targeted attacks are used for fraud or other financially motivated crime. Financial services was the second most frequently targeted sector in the first half of 2006.
Full Chart
Top Originating Countries
During the first six months of 2006, the United States ranked as the top country of attack origin, accounting for 37% of the worldwide total. Attack activity originating in the United States increased by 29% in this period, which is 13 percentage points above the average increase of 16%. This is likely driven by recent growth in broadband infrastructure there. An increase in broadband connectivity in a country often leads to an increase in attacks and bot infections originating there.
Full Chart
Top Cities By Bot-Infested Computers
During the first half of 2006, Beijing was the city with the most bot-infected computers in the world, accounting for almost three percent of the worldwide total. Guangzhou, China ranked second, with just under two percent of the world's bot-infected computers. Seoul, South Korea had the third highest number of bot-infected computers worldwide, accounting for slightly less than two percent of the total. All of the top three cities in this category are large population centers that are cultural and economic centers in their respective countries. Furthermore, all have a large broadband Internet infrastructure.
Full Chart
Distribution of Command-and-Control Servers in Top Ten Bot-Infected Countries
In the first six months of 2006, the United States was the site of 42% of all known command-and-control servers, making it the highest ranked country in this category. The high proportion of command-and-control servers likely indicates that servers in the United States control not only bot networks within the country but offshore as well. The high proportion of bot-infected computers and bot command-and-control servers in the United States is driven by its extensive Internet and technology infrastructure and the fact that more than 49 million broadband Internet users are located there. Although China had the most bot-infected computers worldwide, it had only the fourth highest number of known command-and-control servers worldwide. This discrepancy likely indicates that the majority of bot-infected computers within China are being controlled from servers in other countries.
Full Chart
Top Countries Targeted by Bot-Infected Computers
China had the highest number of bot-infected computers during the first half of 2006, accounting for 20% of the worldwide total. This ranking represents a rise from third place in the second half of 2005. Bots usually infect computers that have high-speed broadband connections to the Internet through large ISPs, and the expansion of broadband connectivity often facilitates the spread of bots. Frequently, ISPs will focus their resources on meeting growing broadband demand at the expense of implementing security measures, such as port blocking and ingress and egress filtering. As a result, ISPs that are expanding their services rapidly may have security infrastructures that are underdeveloped relative to their needs.
Full Chart
Top Sectors Targeted by Denial of Service Attacks
The sector most frequently targeted by DoS attacks in the first half of 2006 was the Internet service provider (ISP) sector, which was targeted by 38% of all DoS attacks. ISPs are popular targets for several reasons. First, they are responsible for providing Internet service to a high number of users. By successfully attacking an ISP, an attacker can effectively create denial of service conditions for a high number of users at one time. Second, ISPs also host Web sites and provide Internet access to many potential target organizations. Attackers wanting to target an organization's Web sites or networks could do so by launching a DoS attack against the organization's ISP. The second most popular target of DoS attacks during the first half of 2006 was the government sector, which was targeted by 32% of all detected attacks. Government Web sites typically are high-profile sites, so it is logical that the government sector is a popular target for DoS attacks.
Full Chart
Top Countries Targeted by Denial of Service Attacks
Between January 1 and June 30, 2006 the United States was the location of the most DoS targets, accounting for 54% of the worldwide total. The prominence of the United States as a target is not surprising. The country's extensive broadband Internet infrastructure and its high proportion of Internet-connected organizations make it a very attractive target. China was targeted by the second highest number of DoS attacks, accounting for 12% of the total. The United Kingdom was the third most common target, accounting for 11% of all detected attacks. Like the United States, both China and the United Kingdom have an extensive broadband Internet infrastructure. Both countries are also regional and global political and economic centers. As a result, attackers who are acting on financial or political motives may choose to target these countries.
Full Chart
Denial of Service Attacks Per Day
During the first six months of 2006, an average of 6,110 denial of service (DoS) attacks per day were detected. DoS attacks are generally carried out by a wide variety of attackers, from amateurs who simply download a freely available tool, to owners of highly organized bot networks whose primary purpose is to carry out coordinated attacks. Defending against DoS attacks that use forged source addresses is difficult, as spoofed addresses make filtering based on the IP address very complicated. Some operating systems have configuration options that may be used to make the computers less prone to resource exhaustion, thereby making them more resilient against DoS attacks. Administrators should optimize this to minimize the effects of DoS attacks.
Full Chart
Top Attacks Against Wireless Networks
The most common wireless threat detected between January 1 and June 30, 2006 was a device probing for an access point, which accounted for 30% of all threatening activity. A device probing for a wireless network access point is one that is noisily trying to connect with an access point using any service set identifier (SSID). An organization's wireless security can be threatened by devices probing for an access point in two ways. The first is by attackers roaming urban areas attempting to locate and connect to wireless networks, a practice that is known as war driving. The second way in which an organization can be threatened by devices probing for wireless access points is through authorized, albeit poorly configured, computers trying to connect to an access point using any SSID. Although apparently innocuous, this could be more damaging to an organization than war driving.
Full Chart
Distribution of Attacks Targeting Web Browsers
During the first six months of 2006, Microsoft Internet Explorer was the most frequently targeted Web browser. It was targeted by 47% of all known attacking IP addresses. The prominence of Microsoft Internet Explorer is not surprising considering the number of vulnerabilities that affect it. Furthermore, on a worldwide basis, it is the most widely deployed browser. Some attacks target vulnerabilities that are present in multiple Web browsers. Browsers that fall within the "multiple browsers" category include Apple Safari, KDE Konqueror, the Mozilla Browser family, Netscape, Opera, Microsoft Internet Explorer, and others. Attacks targeting multiple browsers were the second most common during the first half of 2006, accounting for 31% of all attacking IP addresses.
Full Chart
Top Web Browser Attacks
The most common attack carried out against Web browsers between January 1 and June 30, 2006 was the Multiple Browser Zero Width GIF Image Memory Corruption Attack, which accounted for 31% of all detected Web browser attacks. This attack exploits the vulnerability of the same name, which was first disclosed in September 2002 and affects older Netscape, Mozilla, Galleon, and Opera Web browsers. This attack is carried out when a user loads a Web site containing a graphics interchange format (GIF) image file with a width field that is set to zero.
Full Chart
Phishing Activity By Sector
The financial sector was the most heavily phished sector during the first six months of 2006, accounting for 84% of phishing sites tracked. Phishing attacks against the financial services sector are most likely to produce the greatest monetary gain for attackers. Once an attacker gains access to a target's account through one of these attacks, he or she can initiate wire transfers to remove funds, apply for loans, credit lines, or credit cards. Further evidence of the high concentration of phishing activity targeting the financial sector is the fact that nine of the top ten brands phished this period were from that sector.
Full Chart
Number of Unique Phishing Messages
Over the first six months of 2006, 157,477 unique phishing messages were detected. This is an increase of 81% over the 86,906 unique phishing messages that were detected in the last half of 2005. It is also an increase of 61% over the 97,592 messages detected in the first half of 2005. This sharp increase over the previous six-month period may be a result of attempts by attackers to bypass filtering technologies by creating multiple randomized messages.
Full Chart
Active Bot Network Computers Per Day
Bot networks are groups of compromised computers on which attackers have installed software that listens for and responds to commands, typically using Internet relay chat (IRC), thereby giving the attacker remote control over the computers. In the first six months of 2006, an average of 57,717 active bot network computers per day were observed. During this period, 4,696,903 distinct bot network computers were identified as being active at any point in time during the six-month period.
Full Chart
Web Browser Vulnerabilities
In the first six months of 2006, 47 vulnerabilities were documented that affected Mozilla browsers, including Mozilla Firefox and the Mozilla Browser. This is a significant increase over the 17 vulnerabilities that were disclosed in the second half of 2005. The Mozilla Foundation released multiple revisions of Firefox and Mozilla during this period to address the majority of these vulnerabilities. In the first half of 2006, 38 new vulnerabilities were documented in Microsoft Internet Explorer. This is a 52% increase over the 25 vulnerabilities published in the preceding six-month period. The continued prevalence of Internet Explorer vulnerabilities is likely due to the widespread deployment of the browser. During this reporting period, 12 vulnerabilities were disclosed that affected Apple Safari. This is double the six reported in the second half of 2005.
Full Chart
Web Browsers Window of Exposure
In the first half of 2006, Internet Explorer had a window of exposure of nine days, down considerably from 25 days in the second half of 2005. Apple Safari had a window of exposure of five days, up from zero days in the second half of 2005. In the first half of 2006, Opera had a window of exposure of two days, down considerably from 18 days during the second half of 2005. In the first half of this year, Mozilla had a window of exposure of one day. In the second half of 2005, Mozilla had a window of exposure of negative two days, meaning that exploit code in that period was generally released after patches were available.
Full Chart
Operating System Patch Development Time
The time period between the disclosure date of a vulnerability and the release date of an associated patch is known as the "patch development time." During the first six months of 2006, Microsoft had an average patch development time of 13 days, a significant decrease from 34 days in the last half of 2005. Red Hat also had an average patch development time of 13 days for the first six months of 2006, a drop from 28 days in the last half of 2005. Apple had the third shortest time to patch at 37 days. This is a significant reduction from the 73-day average for 27 vulnerabilities in the second half of 2005.
Full Chart
Window of Exposure, Enterprise Vendor
The window of exposure is the difference in days between the time at which exploit code affecting a vulnerability is made public and the time at which the affected vendor makes a patch available to the public for that vulnerability. In the first six months of 2006, the average patch development time for software developed by enterprise vendors was 31 days. The average exploit code development time during the same period was three days. As a result, the window of exposure for this reporting period was 28 days. In the second half of 2005, the window of exposure was 50 days. In the first half of 2005, it was 60 days.
Full Chart
Top Sectors Targeted by Denial of Service Attacks
The sector most frequently targeted by denial of service (DoS) attacks in the first half of 2006 was the Internet Service Provider (ISP) sector, which was targeted by 38% of all DoS attacks. ISPs are popular targets for several reasons. First, they are responsible for providing Internet service to a high number of users. By successfully attacking an ISP, an attacker can effectively create denial of service conditions for a high number of users at one time. Second, ISPs also host Web sites and provide Internet access to many potential target organizations. Attackers wanting to target an organization's Web site or networks could do so by targeting the organization's ISP.
Full Chart
Top Targeted Sectors
Between January 1 and June 30, 2006, the home user sector was the most highly targeted sector, accounting for 86% of all targeted attacks. As computers in the home users sector are less likely to have well established security measures and practices in place than other sectors, they are much more vulnerable to targeted attacks. Furthermore, as home users represent a fertile resource for identity theft, it is likely that many of the targeted attacks against them are used for fraud or other financially motivated crime. The financial services sector was the second most frequently targeted in the first half of 2006.
Full Chart
Distribution of Attacks Targeting Web Browsers
In the first six months of 2006, Microsoft Internet Explorer was the most frequently targeted Web browser. Attacks targeting it accounted for 47% of all attacking computers targeting Web browsers. The prominence of Microsoft Internet Explorer is not surprising, as it is the most widely deployed browser worldwide. Furthermore, it had the second highest number of vulnerabilities of all Web browsers during this period.
Full Chart
Top 10 Malicious Code Samples
In the last six months of 2005, Sober.X was the most widely reported malicious code sample. This worm was discovered on Nov. 19, 2005 and was upgraded to a category 3 threat on Nov. 22. Despite the fact that it was released with only a month to go before the end of the year, Sober.X was reported more frequently than any other malicious code sample in the six-month period.
Full Chart
Web Browser Vulnerabilities, Vendor Confirmed
The number of vendor-confirmed Web browser vulnerabilities disclosed during the second half of 2005 was considerably less than the total number of vendor-confirmed and non-confirmed vulnerabilities. While Microsoft Internet Explorer had the highest number of vulnerabilities detected over the last six months of the year, the Firefox browser from Mozilla had the highest number of vendor-confirmed vulnerabilities over the past several reporting periods.
Full Chart
New Win32 Viruses and Worm Variants
Throughout 2005, the number of Win32 threat variants remained high. As of the end of 2005, the total number of Win32 threat variants had surpassed 39,257, indicating that these threats will continue to dominate the landscape for some time to come.
Full Chart
Instant Messaging Threats
Instant messaging (IM) continues to grow rapidly with users in both home and enterprise environments, estimated at 300 million in 2005. However, IM is generally unprotected and unmonitored in consumer and enterprise environments, leaving it vulnerable to attacks. In the second half of 2005, worms were the most common type of malicious code on the top three largest IM services. Worms constituted 91 percent of IM-related malicious code during that time, a nearly 10 percent increase over the 83 percent reported during the first half of the year.
Full Chart
Web Browser Vulnerabilities
Between July and December 2005, 24 new vulnerabilities that affected at least one version of Microsoft's Internet Explorer browser were documented. This is the same number seen in the previous six-month reporting period. The totals in both periods are far lower than the 45 new vulnerabilities detected in Internet Explorer in the second half of 2004. At the same time, the increasingly popular Firefox browser from Mozilla was affected by 17 new vulnerabilities in the second half of 2005. This is a decrease from the 32 vulnerabilities that were documented during the first part of the year.
Full Chart
Total Number of Commercially Acquired Vulnerabilities
Over the past several reporting periods, the number of vulnerabilities that have been commercially disclosed and acquired has increased. However, during the second half of 2005, this trend appears to have reversed. Between July and December 2005, there were 54 commercial vulnerabilities, a decline of 21 percent from the 68 commercial vulnerabilities detected during the first half of the year.
Full Chart
Vulnerabilities Associated with Exploit Code
The proportion of vulnerabilities with exploit code continued to decline in the second half of 2005. Between July 1 and December 31, 2005, exploit code was available for 12 percent of the vulnerabilities disclosed. This is lower than the 14 percent seen in the first half of 2005. During the same reporting period a year ago, exploit code was available for 15 percent of vulnerabilities disclosed.
Full Chart
Web Application Vulnerabilities
Web application vulnerabilities have increased significantly over the past several reporting periods. That was also true during the last six months of 2005, when 69% of vulnerabilities were associated with Web applications. This was a 15% increase over the first half of 2005, when they made up 60% of vulnerabilities.
Full Chart
Volume by Severity
Over the past four six-month recording periods, the vast majority of vulnerabilities were rated either moderate or high severity, with only a small percentage rated low severity. This pattern continued in the last half of 2005, when 45% of vulnerabilities were rated as high severity and 52% of vulnerabilities were rated as moderate severity.
Full Chart
Total Volume of Vulnerabilities, 2001-2005
The second half of 2005 was marked by a slight increase in the total number of vulnerabilities disclosed, with 1,896 new vulnerabilities detected. This is an increase of 1% over the 1,871 new vulnerabilities detected in the first half of 2005. More significantly, however, it is an increase of 34% over the 1,416 new vulnerabilities disclosed during the second half of 2004.
Full Chart
Top Targeted Industries
The financial services industry was the most frequently targeted industry between July 1 and December 31, 2005. Attackers are believed to be turning their attentions to cyber crime -- usually for profit. The financial services industry is considered a popular target for attacks from people seeking to profit from their attacks. During the first half of 2005, the financial services industry was the third most frequent target of attacks.
Full Chart
Top Originating Countries
During the last six months of 2005, the United States was the country of origin of 31% of attacks. This is a slight drop from the 33% of attacks that originated there in the first half of the year and slightly more than the 30% of attacks that originated there in the second half of 2004. China moved up to second position during the second half of 2005, when 7% of all attacks originated there. There was a 153% increase in the volume of attacks originating in China during that period.
Full Chart
DoS Attacks Per Week
During the last half of 2005, an average of 1,402 denial of service attacks were detected per day. This is an increase of 51% over the first six months of the year, when an average of 927 DoS attacks were detected each day. The rise in number of attacks indicates that an entrenched and well-organized community of attackers -- likely bot network owners -- may be beginning to utilize better resources to carry out more attacks.
Full Chart
Top Bot-Infected Countries
Over the last six months of 2005, the United States was the location of the highest number of bot-infected computers of any country, with 26% of bot-infected computers situated there. This is up from the first half of the year, when only 19% of all bot-infected computers were in the United States. The second highest number of bot-infected computers was located in the United Kingdom, with 22% of all bot-infected computers situated there.
Full Chart
Time to Compromise -- Desktop Computers with Firewalls Deactivated
The time to compromise seven different desktop operating systems and configurations was tested during the last six months of 2005. Of the desktop operating systems that were tested, Microsoft Windows XP Professional with no patches had the shortest average time to compromise, at one hour and 12 seconds. The longest time to compromise this system took 20 hours and 18 minutes. The minimum time took one minute and 19 seconds.
Full Chart
Daily Variance in Bot-Infected Computers
The daily variances in the number of bot-infected computers followed a boom-and-bust population curve. Between February and June 2004, the number of bot-infected computers experienced significant growth, driven by the rapid spread of Spybot and Gaobot. A bust occurred between July and December 2004, as security professionals began to harden their computers and networks against bots. During 2005, the number of bot-infected computers seems to have reached the carrying capacity of its environment.
Full Chart
Time to Compromise -- Web Servers
This metric measured the time it took for attackers to compromise an Internet-connected Web server once a new operating system was installed. The measure will help provide insight into how quickly an Internet-connected computer may become compromised. Of the Web servers tested, Windows Server 2000 with no patches had the shortest average time to compromise, roughly one hour and 17 minutes. The minimum time for this server was one minute and 14 seconds. The longest time was 18 hours and 28 minutes. A considerable variation was possible in time to compromise for all types of servers tested.
Full Chart
Top command-and-control countries
Over the last six months of 2005, the United States had the highest proportion of bot command-and-control servers in the world, accounting for 48% of the total. South Korea ranked second with nine percent of the total and Canada ranked third with six percent.
Full Chart
New Win32 virus and worm variants
Over the second half of 2005, more than 10,992 new Win32 viruses and worms were documented. While this is consistent with the 10,866 detected in the first half of the year, it is a 49% increase over the 7,360 documented in the second half of 2004. The significant increase over 2004 is due to the continued development of Win32 worms that implement bot features that attackers can use for financial gain.
Full Chart
DoS attacks per day
Over the last six months of 2005, an average of 1,402 DoS attacks per day were detected. This is an increase of 51% from the first half of 2005, when an average of 927 DoS attacks per day were detected.
Full Chart
Web browser vulnerabilities, vendor confirmed
During the last six months of 2005, the Firefox browser from Mozilla had the highest count of vendor-confirmed vulnerabilities. Thirteen out of the 17 vulnerabilities disclosed for Firefox were vendor confirmed, down from 27 out of 32 in the first half of 2005. Twelve out of the 24 vulnerabilities associated with Microsoft Internet Explorer were confirmed by the vendor, a slight decrease from the 14 out of 24 disclosed between January and June 2005.
Full Chart
Web Browser vulnerabilities, vendor confirmed and non-vendor confirmed
During the last six months of 2005, 24 new vendor-confirmed and non-vendor-confirmed vulnerabilities were disclosed that affected at least one version of Microsoft Internet Explorer. This is the same number that was seen in the previous six-month period. During this reporting period, the increasingly popular Firefox browser from Mozilla was affected by 17 new vendor-confirmed and non-vendor-confirmed vulnerabilities, down from the 32 seen in the previous period.
Full Chart
Top Bot-Infected Countries
The identification of bot-infected computers is important, as a high percentage increases the potential for bot-related attacks to occur. Over the second half of 2005, the United States had the highest number of bot-infected computers of any country, with 26% of bot-infected computers in the world situated there. The United Kingdom accounted for 22% of all bot-infected computers worldwide, the second-highest number during this period.
Full Chart
Top Attacked Ports
Assessing the top attacked ports allows security personnel to understand which ports (and associated services) attackers may be targeting. In the second half of 2005, UDP port 1026 was the most frequently targeted port. It was targeted by 17% of attackers. This is an 88% increase over the first half of 2005, when it was only targeted by 9% of attackers.
Full Chart
Bot-Infected Computers Detected Per Day
O | 
