2013 Threat Report R3 - Infopoint Security · Threat Report 2013 Dell™ SonicWALL™ ... The first Angler Exploit Kit to integrate CVE-2013-0074/3896 • Silence Exploit Kit •

Dell Network Security Threat Report 2013

Dell™ SonicWALL™ Threat Research Team

Contents

Executive summary ............................................................................................................................................................................................................ 3

Notable security events in 2013 ......................................................................................................................................................................................4

Threats by software vendor, 2012 vs. 2013 ............................................................................................................................................................. 5

Software application attacks, 2012 vs. 2013 ........................................................................................................................................................... 6

Newly found CVE in year 2013 .................................................................................................................................................................................. 7

Microsoft product vulnerabilities in 2013 ................................................................................................................................................................ 7

Zero-day vulnerability activity in 2013 ..................................................................................................................................................................... 9

Web-based exploit kits usage in 2013 ...................................................................................................................................................................... 9

SCADA vulnerabilities in 2013 .................................................................................................................................................................................. 10

Dell Global Response Intelligent Defense (GRID) Network™ .................................................................................................................................. 12

Countries with highest ratio of attacks .................................................................................................................................................................. 13

Country-based attack distribution per 1000 firewall .......................................................................................................................................... 14

Typical threat attacks pattern ................................................................................................................................................................................... 15

The most popular IPS attacks................................................................................................................................................................................... 16

Apache vulnerabilities in 2013 .................................................................................................................................................................................. 16

Server attacks ......................................................................................................................................................................................................... 17

Client attacks .......................................................................................................................................................................................................... 17

Most targeted devices/OS ........................................................................................................................................................................................ 17

Cyber-criminal activity in 2013 ................................................................................................................................................................................ 17

New types of attacks in 2013 ................................................................................................................................................................................... 17

Targeted attacks in 2013 ........................................................................................................................................................................................... 18

Top three vulnerabilities ............................................................................................................................................................................................ 18

Malware samples ........................................................................................................................................................................................................ 19

Top Malwares in 2013 ................................................................................................................................................................................................ 19

Microsoft product vulnerability coverage in 2013 ...............................................................................................................................................20

Application traffic usage ................................................................................................................................................................................................. 21

Top 20 most visited websites ................................................................................................................................................................................... 21

Top 16 most visited secured browsing websites .................................................................................................................................................. 21

Top 3 application signatures for various countries ..............................................................................................................................................22

Application signature category distribution ..........................................................................................................................................................23

Application traffic usage for last two months of 2013 ........................................................................................................................................23

Social network traffic usage for last two months of 2013 .................................................................................................................................24

Online shopping traffic for last two months of 2013 ..........................................................................................................................................24

Predictions for 2014 ........................................................................................................................................................................................................25

2

3

Executive summary

• The Threat Research Team detected and prevented more than 1.06 trillion IPS related incidents and blocked more than 1.78 billion malwares downloads.

• There were approximately 4,429 new vulnerabilities reported from CVE and 3,644 related with network attacks. Web relatedvulnerabilities such as browsers or applications continued to occupy the top position.

• In 2013, Dell SonicWALL published 19 security advisories addressing Microsoft bulletins, including five out-of-band zero-daynotifications.

• In 2013, our post infection malware activity detection generated 78 billion hits.

• There were 14 well-known zero-day vulnerabilities released in 2013, Dell SonicWALL covered each in blogs.

• Application control usage increased dramatically in 2013, we saw 77 trillion hits for application traffic control during 2013, comparedto just 24 trillion in 2012.

• South Korea, El Salvador and Egypt had the highest ratio of exploits and malware downloads detected per firewall installed.

• Servers were seen as the number one target for IPS blocked attacks.

• Over 20.1 million unique malware samples collected in 2013, compared to 16 million in 2012.

• Overall, web-based exploit kit usage decreased in 2013; however, for the first time we have seen more sophisticated capabilities suchas the Angler Exploit Kit integrating Microsoft Silverlight vulnerabilities.

4

Notable security events in 2013

• Target retail stores point of sale breach impacts more than 40 million[December 2013]

• Adobe breach impacts more than 38 million users

[October 2013]

• Blackhole Exploit Kit author is arrested resulting in the death of BEK and Cool Exploit Kit[October 2013]

• Website php.net compromised to serve malware[October 2013]

• Edward Snowden leaks 1.7 million classified NSA documents[June 2013]

• Drupal.org, a popular open source content management system (CMS) breach impacts over 1 million users

[May 2013]

• Multiple watering-hole attacks targeting government websites including US Departmentof Labor Website[May 2013]

• LivingSocial breach impacts over 50 Million users[April 2013]

• The biggest DDoS ever, produced 300 gigabit/sec worth of traffic[March 2013]

• U.S. Federal Reserve site breach results in leak of more than 4600 bank executive’s credentials[February 2013]

• Targeted attacks and breaches against large US media outlets[January 2013]

http://online.wsj.com/news/articles/SB10001424127887323926104578276202952260718

http://www.zdnet.com/anonymous-posts-over-4000-u-s-bank-executive-credentials-7000010740/

http://www.securelist.com/en/blog/208194203/The_Biggest_DDoS_Ever_that_Almost_Broke_the_Internet

http://allthingsd.com/20130426/livingsocial-hacked-more-than-50-million-customer-names-emails-birthdates-and-encrypted-passwords-accessed/

http://threatpost.com/watering-hole-attack-claims-us-department-of-labor-website/100081

http://www.zdnet.com/uk/the-worlds-biggest-data-breaches-and-hacks-of-2013_p8-7000023327/

http://en.wikipedia.org/wiki/Edward_Snowden

http://www.pcworld.com/article/2057980/phpnet-compromised-and-used-to-attack-visitors.html

http://en.wikipedia.org/wiki/Blackhole_exploit_kit

http://krebsonsecurity.com/2013/10/adobe-breach-impacted-at-least-38-million-users/

http://www.businessinsider.com/target-credit-card-hackers-2013-12

5

Threats by software vendor, 2012 vs. 2013

Apple did a good job by improving their product security and Microsoft attracted the most attacks.

Top critical vulnerabilities affected vendors 2012:

Top critical vulnerabilities affected vendors 2013:

Software application attacks, 2012 vs. 2013

Apple did a good job by improving their product security and Microsoft attracted the most attacks.

The top 15 most affected products in 2012:

The top 15 most affected products in 2013:

6

Newly found Common Vulnerabilities and Exposures (CVE) in 2013

Microsoft product vulnerabilities in 2013

Our continued participation in the Microsoft MAPP program enabled us to maintain our consistent track record of providing protection within 48 hours of Security Advisories being published.http://technet.microsoft.com/en-us/security/advisorymapp https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=380

The following graph shows vulnerability count by Microsoft product:

Most vulnerable Microsoft products

7

Microsoft product vulnerabilities in 2013 (continued)

Microsoft Out-Of-Band Security Advisories in 2013 address following vulnerabilities:

Elevation of Privilege Vulnerability in Microsoft Kernel Component (CVE-2013-5065)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=628

Memory Corruption Vulnerability in Graphics Component (CVE-2013-3906)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=618

Use-After-Free Vulnerability in Microsoft Internet Explorer (CVE-2013-1347)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=557

The following graph shows vulnerability count by Microsoft product:

8

Zero-day vulnerability activity in 2013

Multiple zero-day attacks exploiting Adobe Flash, Adobe Reader, Oracle Java, and Internet Explorer were observed in the wild. Dell SonicWALL threat team has actively reported on and provided resolutions for all of these attack attempts.

• Adobe Flash Player Remote Code Execution (CVE-2013-0633)

• Adobe Flash Player Remote Code Execution (CVE-2013-0634)

• Use-After-Free Vulnerability in Microsoft Internet Explorer (CVE-2013-1347)

• Use-After-Free Vulnerability in Microsoft Internet Explorer (CVE-2013-3893)

• Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2013-3897)

• Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2013-3918)

• Memory Corruption Vulnerability in Graphics Component (CVE-2013-3906)

• Elevation of Privilege Vulnerability in Kernel Component (CVE-2013-5065)

• Oracle Java Remote Code Execution (CVE-2013-0422)





• Adobe Reader Remote Code Execution (CVE-2013-0640)

Web-based exploit kits usage in 2013

BlackHole is nearly dead with the author’s arrest. However, multiple exploit kits such as Angler Exploit Kit are already taking its place and continued to be active in 2013. Below are some of the notable exploit kits we observed in the wild in 2013:

• BlackHole Exploit KitLast year, Blackhole Exploit Kit was one of the most prevalent exploit kits in serving malware. By the middle of year 2013, the authors released Blackhole 2.1.0. However, in October 2013 the tables were turned when one of its creators, Paunch was arrested. The prevalence of the exploit kit dwindled after that time. Following are some key points related to Blackhole: – Attack vectors: Email and web

– Applications Targeted: Internet Explorer, Chrome, Firefox, Safari, Java, Flash and Adobe Reader.

• Cool Exploit KitAnother exploit kit allegedly created by Paunch that is rapidly disappearing.

• Whitehole Exploit Kit

• Neutrino Exploit Kit

• Angler Exploit KitThe first Angler Exploit Kit to integrate CVE-2013-0074/3896

• Silence Exploit Kit

• Himan Exploit Kit

• Private Exploit Kit

9

http://threatpost.com/blackhole-exploit-kit-author-arrested-in-russia/102537

http://en.wikipedia.org/wiki/Blackhole_exploit_kit

http://www.avgthreatlabs.com/virus-and-malware-information/info/cool-exploit-kit/

http://blog.trendmicro.com/trendlabs-security-intelligence/whitehole-exploit-kit-emerges/

http://www.avgthreatlabs.com/virus-and-malware-information/info/neutrino-exploit-kit/

http://threatpost.com/netflixers-beware-angler-exploit-kit-targets-silverlight-vulnerability/102968

http://malware.dontneedcoffee.com/2013/06/silent-exploit-kit-new-browsoh-wait.html

http://malware.dontneedcoffee.com/2013/10/HiMan.html

http://www.avgthreatlabs.com/virus-and-malware-information/info/private-exploit-kit/

SCADA vulnerabilities in 2013

With the Advent of Stuxnet, and the risks that SCADA systems pose to enterprises, SCADA vendors have been addressing vulnerabilities more proactively than ever before. The following data is gathered from IS-CERT

The below figure shows the distribution of vulnerabilities discovered by vendors in 2013. Siemens topped the list with 34.

SCADA vendor vulnerability count

10

https://ics-cert.us-cert.gov/advisories

SCADA vulnerabilities in 2013

The below figure shows the types of vulnerabilities found in SCADA related products in 2013. Denial of Service attacks topped the list.

SCADA vulnerability count

11

Dell Global Response Intelligent Defense (GRID) Network

Dell SonicWALL’s GRID Network comparatively gathers, analyzes and vets cross-vector threat information from millions of sensors around the world. In 2013, we saw Intrusion Prevention System incidents blocked in the wild increase by over 40% between 2012 and 2013. Dell SonicWALL focuses significant malware research efforts on detecting and blocking post infection malware activity in addition to prevention of the original malware infection. This is clearly reflected in the number of hits we have recorded in the wild for blocking post infection malware activity which includes – communication with Command and Control (C2) server, download of additional malware files, download of updated new variants of itself, etc. This has also resulted in slightly lower malware prevention incidents recorded.

Intrusion prevention incidents:2012 – 727 billion (726,906,572,333)

2013 – 1.06 trillion (1,059,231,965,334)

Malware prevention incidents:2012 – 2.75 billion (2,749,335,841)

2013 – 1.78 billion (1,780,890,310)

Post infection malware activity hits:2013 – 78 billion (78,343,886,047)

Collected malware samples: 2011 – 13.5 million

2012 – 16 million

2013 – 20.1 million

New cloud signatures: 2011 – 3.16 million

2012 – 3.4 million

2013 – 4.0 million

Applications total hits:2012 – 24 trillion (23,787,828,592,965)

2013 – 77 trillion (76,907,540,014,509)

12

Countries with highest ratio of attacks

The following figure shows IPS attacks per 1,000 firewalls by country. El Salvador, Egypt and South Korea were most affected.

The figure outlines malware attacks per 1,000 firewalls by country. South Korea, El Salvador and Egypt were most affected.

13

Country-based attack distribution per 1,000 firewalls

The following figure shows the IPS attack distribution per 1,000 firewalls:

The following figure shows the malware attack distribution per 1,000 firewalls:

14

Typical threat attacks pattern

The following figure shows the IPS attacks that happened during the last two months in 2013. This shows the attacks peak at the mid-week, and slow down during the weekends.

The following shows the malware attack pattern for the same time period.

15

Apache vulnerabilities in 2013

The charts above show the vulnerability distribution for Apache HTTP Server, Struts and Tomcat. Apache HTTP Server was the most attacked with Remote Command Execution being the favorite vulnerability.

The most popular IPS attacks

• Server attacks top the chart and increased in volume compared to last year

• SQL-Injection moved up two places to number two in 2013

• XSS attacks dropped this year but still remain a steady attack vector

Year 2012

Apache vulnerability target

Year 2013

Apache vulnerability types

16

Apache vulnerabilities in 2013

Server attacksTop three blocked server attacks:1. 1529 – HTTP Server Directory Traversal Attack 12. 1081 – HTTP Server Remote Code Execution 7 3. 589 – Suspicious Request URI 7

Client attacksTop three blocked client attacks:1. 7693 – Obfuscated HTML Code 42. 4733 – HTTP Client Shellcode Exploit 17a3. 4816 – Client Application Shellcode Exploit 2

Most targeted devices/OS:

Computers running Microsoft Windows operating systems (Windows XP/7 in particular) and smartphones running the Android operating system topped the list of most targeted devices in 2013.

Cyber-criminal activity in 2013

We are seeing an increasing number of threats in following categories:a) Targeted spam campaigns involving banking Trojans and ransomware

b) Web-based kits which continue to be a major vector used in various targeted attacks involving zero-day exploit attempts followed by drive-by downloads

c) We have seen rise in SSL-based bots as more malware families use SSL-based command and control communication to evade detection

d) The malware economy attributed to Bitcoinminer botnets, ClickFraud botnets, Pay-Per-Install malwares, and more sophisticated Ransomware

• Targeted campaigns involving SSL bot SonicAlert write-ups:https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=597

• https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=623

• Sophisticated Ransomware SonicAlert write-up:https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=601

New types of attacks in 2013

• Rise in SSL bots and SSL-based communication with Command and Control servers by major malware families.

• Ransomware family - CryptoLocker was the first to deploy asymmetric-key encryption to encrypt the data on infected machine. The PGP key pair is generated dynamically on the Command and Control server and the private key is destroyed if payment is not received in 72 hours. It also used a custom Domain Generation Algorithm to hide the Command and Control server. https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=601

17

New types of attacks in 2013 (continued)

• Rise in Bitcoin miner malware family that leverages CPU and GPU processing cycles on infected system to generate revenue.Increase in Bitcoin miner IRC based botnetshttps://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=621,https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=564

• Sophisticated banking malware targeting Android-based smartphone users

• A surge of targeted attacks, such as CVE-2013-3893

https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=602

• Social engineering tactics with sophisticated techniques like MiniDukehttps://www.securelist.com/en/blog/208194129/The_MiniDuke_Mystery_PDF_0_day_Government_Spy_Assembler_Micro_Backdoor, and ASLR/DEP bypass.

• Increasing number of targeted spam campaigns that utilize legitimate harvested/guessed corporate email addresses

• Spam themes have evolved considerably over past few years making them appear more legitimate and greatly increasing thechances of users clicking on the URL or opening the attachments. Many emails we saw pretended to arrive from internal faxmachine, voicemail module, Xerox scanners, and cancelled online orders with legitimate sounding vendor e-mail

• Mobile devices vulnerable to spam text messageshttp://threatpost.com/google-nexus-phones-vulnerable-to-sms-denial-of-service-attack/103066

Targeted attacks in 2013

• Targeted spam against corporate employees leveraging services like Fax, VoiceMail, Printer, Scanner, etc.

• Sophisticated ransomware like CryptoLocker utilizing a custom DGA and asymmetric encryption

• SSL-based malware download and communication

• Web-based exploit kits with zero-day exploit payloads resulting in drive-by malware download and install on the targetedmachine. Below are some examples for recent targeted attacks leveraging zero-day exploits

Top three vulnerabilities:

Cross site scripting attacks• Apache HTTP Server XSS Vulnerability (March 8, 2013)

https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=539

Denial of service attacksIn 2013 there were a couple of significant Denial of Service events.

• nginx Server Denial of Service (May 24, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=563

• Delphi based bot with DDoS capabilities (March 15, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=541

• Oracle MySQL Server Geometry Query DoS (Mar 22, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=543

• Squid Accept-Language Value DoS (April 5th, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=548

• New Russian DDoS botnet discovered (May 1, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=554

18

https://www.securelist.com/en/blog/208194129/The_MiniDuke_Mystery_PDF_0_day_Government_Spy_Assembler_Micro_Backdoor

• C++ based bot with DDOS and spying capabilities (May 10, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=559

• Infostealer Trojan with Bitcoin mining and DDoS features (May 30, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=564

• Samba read_nttrans_ea_list Function DoS (Aug 22, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=591

Client application use-after-free AttacksMultiple use-after-free vulnerabilities exploits were found in the wild in year 2013. The following are the SonicAlerts about use-after-free attacks released this year:

• Windows IE Use-After-Free Vulnerability MS13-047 (June 21, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=572

• Firefox onreadystatechange Use-after-free Vulnerability (Aug 9, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=587

• Microsoft Windows IE Memory Corruption (Sept 18, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=600

• Microsoft Windows IE Vulnerability CVE-2013-3893 (September 26, 2013) (https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=602

• Microsoft Windows IE Vulnerability CVE-2013-3897 (October 8, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=607

• Microsoft Windows IE Vulnerability CVE-2013-1347 (Oct 17, 2013) https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=610

Malware samples

We collected about 20.1 million unique malware samples in 2013, which is an increase compared to 16 million in 2012. That averages to about 55,000 new samples coming in each and every per day.

Top Malware in 2013

• Cryptolocker Ransomware family was one of the most notable and nastiest

• SSL bots in conjunction with targeted spam campaigns targeting corporate email addresses with legitimate themes represented new observations in 2013

• Banking Trojans including Zeus and Cridex continued to be prevalent in the wild via drive-by-downloads and email spam campaigns

• With the increase in Bitcoin value (peaking at 1200 USD) we also saw an increase in the number of Bitcoin malware family and IRC based botnets

19

Microsoft product vulnerability coverage for 2013

• Microsoft Security Bulletin Coverage (Dec 10, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=631

• Microsoft out-of-band Security Advisory for Windows Kernel (Nov 27, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=628

• Microsoft Security Bulletin Coverage (Nov 12, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=498

• Microsoft out-of-band Security Advisory for Graphics Component (Nov 5, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=618

• Microsoft Security Bulletin Coverage (Oct 8, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=608

• Microsoft Security Bulletin Coverage (Sept 10, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=598

• Microsoft Security Bulletin Coverage (Aug 13, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=589

• Microsoft Security Bulletin Coverage (July 9, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=578

• Microsoft Security Bulletin Coverage (June 12, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=568

• Microsoft Security Bulletin Coverage (May 14, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=560

• Microsoft out-of-band Security Advisory for IE 8 (May 4, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=557

• Microsoft Security Bulletin Coverage (Apr 9, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=549

• Microsoft Security Bulletin Coverage (Mar 12, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=540

• Microsoft Security Bulletin Coverage (Feb 12, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=526

• Microsoft Security Bulletin Coverage (Jan 8, 2013)https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=514

Microsoft MAPP program consistently recognized us as providing protection within 48 hours to our customers limit. http://technet.microsoft.com/en-us/security/advisorymapp

Microsoft related vulnerabilities covered by Dell SonicWALL:https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=380

20

Application traffic usage

Top 20 most visited websites.

Top 16 most visited secured browsing websites.

21

Top 3 application signatures for various countries

Category Signature ID Signature Name

VoIP-APPS 6589 RTP — G711 PCMU Audio

PROTOCOLS 5147 HTTP — GET

PROTOCOLS 5159 SSL — TLSv1.0 (SSLv3.1) Client Hello








PROTOCOLS 5148 HTTP — POST



PROTOCOLS 4413 POP — TCP 110









PROTOCOLS 5148 HTTP — POST

United States (North America)

United Kingdom (Europe)

South Africa (Africa)

Italy (Europe)

Indian (Asia)

China (Asia)

22

Application signature category distribution

In 2013, we covered more popular applications. The following figure shows the category distribution of Dell SonicWALL application signatures.

Application traffic usage for last two months of 2013

23

Social network traffic usage for last two months of 2013

Online shopping traffic for last two months of 2013

24

Predictions for 2014

• Mobile devices will see an increasing number of vulnerabilities, sophisticated malware attacks and possibly mobile botnets. Android will continue to be the leading platform for mobile attacks.

• Sophisticated hybrid malware will utilize mobile devices to infiltrate and spread across corporate networks.

• Social-engineering attacks — such as Watering-hole attacks — will continue to be an important vector for targeted attacks.

• With BlackHole Exploit Kit infrastructure nearly dead with the author’s arrest, we are predicting a new successor will emerge with more advanced features that leverage zero-day exploits and target a wide variety of platforms (Windows/Mac/Linux PCs and Android/Windows 8 tablets/smartphones).

• Windows XP will still be targeted while its support life cycle is ending in year 2014.

• Windows 7/8 will be more targeted as Windows XP usage is dwindling.

• More Social Networks will be utilized as attack vectors.

• Theft of user credentials and personal data will continue

• Ransomware will continue to be active

• Bitcoin related attacks, such as mining botnets, will increase.

For more information

Dell SonicWALL2001 Logic DriveSan Jose, CA 95124

www.sonicwall.comT +1 408.745.9600F +1 408.745.9300

© 2014 Dell, Inc. ALL RIGHTS RESERVED. Dell, Dell Software, the Dell Software logo and products—as identified in this document—are registered trademarks of Dell, Inc. in the U.S.A. and/or other countries. All other trademarks and registered trademarks are property of their respective owners.Report-2013DellSonicWALLThreatReport-US-TD593-20140123

Dell Software5 Polaris Way, Aliso Viejo, CA 92656 | www.dell.com If you are located outside North America, you can find local office information on our Web site.

2013 Threat Report R3 - Infopoint Security · Threat Report 2013 Dell™ SonicWALL™ ... The first Angler Exploit Kit to integrate CVE-2013-0074/3896 • Silence Exploit Kit •

Documents