Near all, 97pc of malware is unique to a specific endpoint, rendering signature-based security virtually useless, according to the annual Webroot Threat Brief by the IT security product company.
The firm described IT threats as truly global and highly dynamic. Many attacks are staged, delivered, and terminated within a matter of hours, or even minutes, having harvested user credentials and other sensitive information.
Findings include:
– Malware and potentially unwanted applications (PUAs) have become overwhelmingly polymorphic. By changing attributes to evade detection, polymorphic threats pose a major problem for traditional, signature-based security approaches, which often fail to discover singular variants.
– About 50 percent of Webroot users experienced a first contact with a zero-day phishing site, as compared to approximately 30 percent in 2014. This data indicates that zero-day phishing attacks are becoming the hacker’s choice for stealing identities.
– Technology companies, including Google, Apple and Facebook, were targeted by more than twice as many phishing sites as financial institutions, such as PayPal, Wells Fargo, and Bank of America. These tech companies are targeted because the same login credentials are often used to access many other websites, resulting in multiple compromised accounts with each phishing victim.
– 100,000 net new malicious IP addresses were created per day in 2015, a significant increase from the 2014 average of 85,000 a day indicating cybercriminals rely less on the same list of IPs, and are expanding to new IPs to avoid detection.
– The United States continues to have the most malicious IP addresses of all countries. In 2015, it accounted for over 40 percent of all malicious IP addresses, a significant increase from 31 percent of malicious addresses in 2014. Top countries hosting 75 percent of malicious IPs include the US, China, Japan, Germany, and the UK.
– As with malicious IP addresses, malicious URLs are largely hosted in the U.S. (30 percent), followed by China (11 percent). Furthermore, the U.S. is by far the largest host of phishing sites, with 56 percent of sites within its borders.
– In the second half of 2015, 52 percent of new and updated apps were unwanted or malicious—a significant increase over the first half of 2014, when only 21 percent were unwanted or malicious.
The 2016 Threat Brief provides an overview of the internet threat landscape during 2015, spanning threats from websites, malicious IPs, malware, and mobile applications.
Hal Lonas, chief technology officer at Webroot, said: “2015 was yet another record year for cybercrime, during which more malware, malicious IPs, websites, and mobile apps were discovered than in any previous year.
“It comes as no surprise to those of us in the Internet security industry that the cybercrime ecosystem continues to thrive, given new innovations and little in the way of risk for those who choose to participate. The continued onslaught of hacks, breaches, and social engineering scams targeting individuals, businesses, and government agencies alike has caused many in the security field to ask if it’s truly possible to defend against a persistent attacker. We conclude that we can only succeed by being more innovative than our criminal opponents.”
For a copy of the Webroot 2016 Threat Brief, visit Webroot at booth #3837 at RSA Conference 2016 in San Francisco on February 29 to March 4, or download the report online: www.webroot.com/Webroot-2016-Threat-Brief.pdf.
Comment
Paul McEvatt, Senior Cyber Threat Intelligence Manager, UK and Ireland at Fujitsu, said: “The research by Webroot further supports our view that traditional security controls are no longer sufficient in any network, let alone an enterprise environment. Can a business afford to rely on signature based platforms such as antivirus and intrusion detection with the polymorphic nature of these threats?
“Whilst antivirus and IDS still have a place in a modern day business, organisations must take a proactive and intelligence driven approach to security such as proactively monitoring phishing campaigns that evade traditional based mail gateways. This will help businesses get on the front foot and shorten the time to detection.”
