News Release
Symantec Internet Security Threat Report Identifies More Attacks Now Targeting E-Commerce, Web Applications
Short Vulnerability-to-Exploit Window, Rise in Bot Networks, Increase in Severe/Easy-to-Exploit Vulnerabilities
Symantec Corp. (Nasdaq: SYMC), the global leader in information security, today released its newest Internet Security
Threat Report. The sixth bi-annual report provides analysis and discussion of trends in internet attacks,
vulnerabilities, and malicious code activity for the period of January 1, 2004 to June 30, 2004.
“As this latest Internet Security Threat Report demonstrates, exploits are being created more easily and faster than
ever, while attackers are launching more sophisticated attacks for financial gain,” said Arthur Wong, vice president,
Symantec Security Response and Managed Security Services.
“Software vulnerabilities and targeted attacks remain a primary area of concern for organisations and individuals. By
publishing a comprehensive and accurate update on internet threat activity, Symantec is providing the information
security community the information needed to effectively secure systems now and in the future.” Key Findings Increased
Threats to e-Commerce: During this reporting period, e-Commerce was the single most targeted industry, with nearly 16
percent of attacks against it.
This represents a 400-percentage increase from the four percent reported during the previous six months. This rise may
indicate a shift from attacks motivated by notoriety to attacks motivated by economic gain. This possibility is further
illustrated by an increase in phishing scams and spyware designed to steal confidential information and pass it along to
attackers.
Attacks Against Web Application Technologies Are Increasingly Popular: Web application technologies are appealing
targets for attacks because of their widespread deployment within organisations and the relative ease with which they
can be exploited. Web applications allow attackers to gain access to the target system simply by penetrating one
end-user’s computer, bypassing traditional perimeter security measures.
Nearly 82 percent of documented web application vulnerabilities were classified as easy to exploit, thereby representing
a significant threat to an organisation’s infrastructure and critical information assets. Short Time Between
Vulnerability and Exploit: According to the report, the time between the announcement of a vulnerability and the release
of associated exploit code was extremely short. Symantec data indicates that over the past six months, the average
vulnerability-to-exploit window was just 5.8 days.
Once an exploit has been released, the vulnerability is often widely scanned for and quickly exploited. This short
window leaves organisations with less than a week to patch vulnerable systems.
Rise in Bot Networks: Adding to concern about the short vulnerability-to-exploit window is the growth in bots (short for
“robot”). Bots are programs that are covertly installed on a targeted system, allowing an unauthorised user to remotely
control the computer for a wide variety of purposes. Attackers often coordinate large groups of bot-controlled systems,
or bot networks, to scan for vulnerable systems and use them to increase the speed and breadth of their attacks. Over
the past six months, Symantec has seen a large increase in the number of remotely controlled bots. During the first six
months of 2004, the average number of monitored bots rose from under 2,000 to more than 30,000 per day – peaking at
75,000 in one day.
Bot networks create unique problems for organisations because they can be remotely upgraded with new exploits very
quickly, which could potentially allow attackers to outpace an organisation’s security efforts to patch vulnerable
systems. Increase in Severe, Easy-to-Exploit Vulnerabilities: Symantec documented more than 1,237 new vulnerabilities
between January 1 and June 30, 2004, an average of 48 new vulnerabilities per week.
Seventy percent of these vulnerabilities were considered easy to exploit, and 96 percent were considered moderately or
highly severe. Consequently, organisations must contend with an average of more than seven new vulnerabilities per day,
and a significant percentage of these vulnerabilities could result in a partial or complete compromise of the targeted
system. Attack Trends The Slammer worm was the most common attack over the past six months, with 15 percent of attacking
IP addresses performing an attack related to it. Gaobot and its variants were the second most common attack, increasing
by more than 600 percent over the past six months. Overall, the daily volume of attacks is decreasing due to a decline
in internet-based worm attack activity over the first six months of 2004.
E-Commerce received the most targeted attacks of any industry during this period; small business received the second
most. The United States was the top attack source country with 37 percent, down from 58 percent in the previous six
months. Other countries rose accordingly, indicating that attack activity is becoming more international. Eighty-seven
percent of Symantec Managed Security Services clients with tenure of more than six months successfully avoided
experiencing a severe attack. Vulnerability Trends During the first six months of 2004, the average time between the
public disclosure of a vulnerability and the release of an associated exploit was 5.8 days.
The Symantec Vulnerability Database documented 1,237 new vulnerabilities between January 1 and June 30, 2004. Ninety-six
percent of documented vulnerabilities disclosed during this period were rated as moderately or highly severe; 70 percent
of vulnerabilities were considered easy to exploit; 64 percent of vulnerabilities for which exploit code is available
were considered high severity. In the first half of 2004, 479 vulnerabilities – or 39 percent of the total volume – were
associated with web application technologies. Malicious Code Trends Over the past six months, Symantec documented more
than 4,496 new Windows viruses and worms (particularly Win32), more than 4.5 times the number in the same period in
2003. The number of distinct variants of bots is rising dramatically, increasing by 600 percent over the past six
months. Peer-to-peer services (P2P), Internet relay chat (IRC), and network file sharing continue to be popular
propagation vectors for worms and other malicious code. Adware is becoming more problematic, making up six of the top 50
malicious code submissions.
The first malicious worm for mobile devices, Cabir, was developed. Future and Emerging Trends Client-side attacks are
expected to increase in the near future. Targeted attacks on firewalls, routers, and other security devices protecting
users’ systems are also a growing security concern. Symantec expects bot networks to employ increasingly sophisticated
methods of control and attack synchronisation that are difficult to detect and locate.
Symantec also expects to see instances of port knocking, a method attackers may use to create direct connections to
potential target systems. Symantec expects that recent Linux and BSD vulnerabilities that have been discovered and used
in proof-of-concept exploits will be used as exploit-based worms in the near future. Symantec also expects to see more
attempts to exploit mobile devices. About the Symantec Internet Security Threat Report Symantec has some of the most
comprehensive sources of threat data in the world.
The findings of the Internet Security Threat Report are based on data from Symantec DeepSight Threat Management System
and Symantec Managed Security Services customers as well as from 20,000 security devices deployed in more than 180
countries. In addition, the report leverages threat data gathered by experts in Symantec’s five Security Operations
Centres and nine Response Labs throughout the world. Symantec also gathers malicious code from more than 120 million
client, server, and gateway systems that have deployed Symantec’s antivirus products in both consumer and corporate
environments.
About Symantec Symantec is the global leader in information security providing a broad range of software, appliances and
services designed to help individuals, small and mid-sized businesses, and large enterprises secure and manage their IT
infrastructure. Symantec’s Norton brand of products is the worldwide leader in consumer security and problem-solving
solutions. Headquartered in Cupertino, Calif., Symantec has operations in more than 35 countries. More information is
available at http://www.symantec.com. ###
NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the
Symantec Press Centre at http://www.symantec.com/PressCenter/ on Symantec's Web site.
Symantec, the Symantec logo, and Brightmail are trademarks or registered trademarks, in the United States and certain
other countries, of Symantec Corporation. Additional company and product names may be trademarks or registered
trademarks of the individual companies and are respectfully acknowledged.
ENDS