The following statistics are compiled from Fortinet's FortiGate network security appliances and intelligence systems for the period June 21st - July 20th, 2009.
Top 10 exploitation attempts detected for this period, ranked by vulnerability traffic. Percentage indicates the portion of activity the vulnerability accounted for out of all attacks reported in this edition. Severity indicates the general risk factor involved with the exploitation of the vulnerability, rated from low to critical. Critical issues are outlined in bold:
Figure 1a: Top 5 regions by detected exploit attempts
Malware Today
Top 5 regions for this period, ranked by distinct malware volume reported. Distinct malware volume indicates the amount of unique virus names (variants) that has been detected in the given regions, as opposed to total malware volume, which indicates the accumulated amount of all reported incidents. Total and unique malware volume trends for the last six reporting periods are also given. Figures 3a-3c below show these statistics:
For more information on daily activity per region, please visit our Virus World Map.
Spam and Email Threats
Top three email threats observed for this period. Top e-mails have been filtered to highlight diverse campaigns by removing duplicates and unsolicited advertisements. This helps focus on scams and malicious intent; the resulting list is ranked by Figures 5a-c below illustrate the most popular message tactics used during recent spam campaigns:
The following list breaks down the percentage of activity blocked for selected Web categories throughout this period. Percentage indicates how much activity was accounted for out of the four selected categories. Figure 6a shows a different scope, comparing only threat traffic: Malware, spyware, and phishing. The percentage shown in Figure 6a below indicates how much activity was accounted for out of these three threat categories. Figure 6b highlights the growth (or reduction) of selected web threat activity when compared period over period:
The end of June through July saw many interesting events unfold on the threat landscape. With malware, online gaming trojan detection remained king this period with W32/OnlineGames.BBR maintaining and building heavily from its first place position last report - accounting for 43 percent of total detected malware activity. This latest attack, as seen in Figure 2, saw much of its volume from July 5th onward, with a peak of activity on July 8th. This campaign continues, and comes in very frequent activity on a daily basis. Besides that, the regular faces of W32/Virut.A and JS/PackRedir built on their activity from our last report period. In fact, detected activity for W32/Virut.A this period climbed to record levels, underscoring the fact that this behemoth has become a dominant threat - particularily in Asia. New to this report's top ten is W32/FakeAlert.EI - another rogue antivirus ("scareware") trojan. Scareware fraud continues to be vastly popular in the digital underground, now quite diversified since we first reported on heavy attack waves nearly one year ago in August 2008. In July we saw the emergence of SymbOS/Yxes.E and SymbOS/Yxes.F, the latest updated variants of Yxes that we first reported on in February. For further details, check out this blog post that is well worth the read: in particular, Yxes' served up dynamic content via JSP indeed shows the beginning steps as to how cyber criminals are addressing a market that is largely fragmented due to multiple platforms. This is important, because malicious binaries are often written for a single target (ie: Windows, OS/X). On traditional desktops, these targets are limited: however, in the mobile market, they are growing and diversifying. Thus, dynamically addressing which malware packages to serve up, as Yxes has done, is a technique which helps alleviate this issue and hints of what is to come in this area in the near future.
Although the active exploit rate of new vulnerabilities (Figure 1b) cooled down to 30 percent from an annual record in excess of 55 percent last report, there is still plenty to be concerned about. Most notably, two in the wild exploits were making waves this period. One is the highly discussed MS ActiveX Video control (CVE-2008-0015, FortiGuard Advisory here) first patched on July 14th by Microsoft through MS09-032. Exploit activity for this vulnerability was frequent throughout the month, but remained relatively low, with most prevalent activity detected in Korea, China and Japan. As of writing, the second mentioned vulnerability, MS Office Web Components (CVE-2009-1136, FortiGuard Advisory here) remains unpatched / zero-day, also with relatively low detection rates with leading activity in China, India and Japan. Nonetheless, it should be reminded that any successful exploit can cause significant damage; exploits against the latter (zero-days) tend to be more successful since patches are not readily available. FortiGuard IPS detects and blocks malicious activity against both of these attacks as mentioned in their respected advisories above. The FortiGuard Global Security Research team first spotted public exploit code for this second mentioned vulnerability on July 11th and immediately reported the findings.
The world of spam continues to evolve, with eCards proving to be the favored social engineering hook - especially when it comes to Canadian Pharmacy. This month, we witnessed an assault of eCard spam continuing from last month, using various techniques - a majority of them ultimately leading victims to Canadian Pharmacy's domains. These domains, automatically registered by combining two dictionary words as described in our January 2008 write-up, continue to be registered well over two years since the process began. Canadian Pharmacy's success, fueled by an affiliate sponsorship model, invites many cyber criminals to advertise the fraudulent pharmaceuticals and drive traffic to the aforementioned domains on their behalf. The net result lands rather large chunks of change in both the Canadian Pharmacy gang and affiliates' pockets. This becomes apparent through the various spam campaigns and techniques observed (as visually demonstrated in Figures 5a/5b and last month's Figure 5c). This period, the eCard spam primarily used direct links (Figure 5a), Google Groups and the photo sharing service Tinypic (Figure 5b).
While the automatic redirection used by the Google Groups campaign is not new, Tinypic is quite interesting as it serves as another example of how spam continues to reach out to emerging platforms. While traditional spam has not ceased to exist through email, we have predicted and reported on many spam attacks through new "Web 2.0" platforms such as social networking sites. To help evade detection, cyber criminals have used services such as Tinyurl in the past to obfuscate their malicious URLs. Tinypic is a similar, recent example of how legitimate service providers are commonly used nowadays to piggyback malicious resources. Regardless of the image, or what the link appears to be, always observe where any hyperlink will actually take you and exercise due care. Figure 5c illustrates the July 4th Independence Day attack utilized by Waledac in their latest wave of social engineering attacks through their growing peer to peer network of zombies. In terms of overall activity, spam rates continue to hold at high levels, while Japan jumped ahead of the USA into 2nd position for spam volume this period (Figure 4b). Out of the four threat categories sampled, traffic to web sites hosting malware remained high at a 38.7% share of total activity throughout these categories.
Customers who use Fortinet’s FortiGuard Subscription Services should already be protected against the threats outlined in this report. Threat activity is compiled by Fortinet's FortiGuard Global Security Research Team using data gathered from its intelligence systems and FortiGate™ multi-threat security appliances in production worldwide. FortiGuard Subscription Services offer comprehensive security solutions including antivirus, intrusion prevention, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products.
Table of Contents:
|
 FortiGuard Global Threat Research |
Exploits and Intrusion Prevention
Top 10 Exploitations & Regions
Top 10 exploitation attempts detected for this period, ranked by vulnerability traffic. Percentage indicates the portion of activity the vulnerability accounted for out of all attacks reported in this edition. Severity indicates the general risk factor involved with the exploitation of the vulnerability, rated from low to critical. Critical issues are outlined in bold:
| Rank | Vulnerability | Percentage | Severity |
|---|---|---|---|
| 1 | MS.DCERPC.NETAPI32.Buffer.Overflow | 10.8 | Critical |
| 2 | HTTP.URI.Overflow | 10.1 | Critical |
| 3 | MS.SMB.DCERPC.SRVSVC.PathCanonicalize.Overflow | 5.1 | High |
| 4 | MS.Windows.ASN.1.Bitstring.Overflow | 1.8 | High |
| 5 | Hidden.Iframe.Injection.Attack | 1.7 | Medium |
| 6 | MS.IE.HTML.Attribute.Buffer.Overflow | 1.6 | High |
| 7 | MS.Exchange.Mail.Calender.Buffer.Overflow | 1.4 | High |
| 8 | PNG.Image.Integer.Overflow | 1.3 | Critical |
| 9 | FTP.Bounce.Attack | 1.2 | High |
| 10 | CRC32.SSH.NOOP | 1.0 | Critical |
Figure 1a: Top 5 regions by detected exploit attempts
New Vulnerability Coverage
|
There were a total of 89 vulnerabilities added to FortiGuard IPS coverage this period.
Of these added vulnerabilities, 27 were reported to be actively exploited (30.3%). Figure 1b breaks down added vulnerabilities by severity, coverage and active exploitation in the wild. For more information, observe the detailed reports for this period at: |
 Figure 1b: New vulnerability coverage for this edition, categorized by severity |
Malware Today
Top 10 Variants
Top 10 malware activity by individual variant. Percentage indicates the portion of activity the malware variant accounted for out of all malware threats reported in this edition. Top 100 shifts indicate positional changes compared to last edition's Top 100 ranking, with "new" highlighting the malware's debut in the Top 100. Figure 2 below shows the detected volume for the malware variants listed within the Top 5:
|
 Figure 2: Activity curve for top five malware variants |
Regions & Volume
Top 5 regions for this period, ranked by distinct malware volume reported. Distinct malware volume indicates the amount of unique virus names (variants) that has been detected in the given regions, as opposed to total malware volume, which indicates the accumulated amount of all reported incidents. Total and unique malware volume trends for the last six reporting periods are also given. Figures 3a-3c below show these statistics:
 Figure 3a: Top 5 regions by distinct malware volume |
 Figure 3b: Six period trend for total malware volume |
 Figure 3c: Six period trend for unique malware volume |
For more information on daily activity per region, please visit our Virus World Map.
Spam and Email Threats
Spam Rate & Regions
The global spam rate is shown on a daily basis for this edition's given period. Spam rate indicates the accumulated emails which have been tagged as spam, in comparison to total email traffic. Top 5 spam regions are ranked by received spam in comparison to global spam volume. Statistics are graphed for business working days, and shown in Figures 4a-4b below:
 Figure 4a: Spam rate compared to global email |
 Figure 4b: Top 5 spam regions by received spam |
Top 3 In The Wild
Top three email threats observed for this period. Top e-mails have been filtered to highlight diverse campaigns by removing duplicates and unsolicited advertisements. This helps focus on scams and malicious intent; the resulting list is ranked by Figures 5a-c below illustrate the most popular message tactics used during recent spam campaigns:
 Figure 5a: Spam campaign #1 |
 Figure 5b: Spam campaign #2 |
 Figure 5c: Spam campaign #3 |
Crawling The Web
Threat Traffic & Growth
The following list breaks down the percentage of activity blocked for selected Web categories throughout this period. Percentage indicates how much activity was accounted for out of the four selected categories. Figure 6a shows a different scope, comparing only threat traffic: Malware, spyware, and phishing. The percentage shown in Figure 6a below indicates how much activity was accounted for out of these three threat categories. Figure 6b highlights the growth (or reduction) of selected web threat activity when compared period over period:
|
 Figure 6a: Threat traffic volume break-down |
 Figure 6b: Threat traffic growth by period |
Activity Recap
The end of June through July saw many interesting events unfold on the threat landscape. With malware, online gaming trojan detection remained king this period with W32/OnlineGames.BBR maintaining and building heavily from its first place position last report - accounting for 43 percent of total detected malware activity. This latest attack, as seen in Figure 2, saw much of its volume from July 5th onward, with a peak of activity on July 8th. This campaign continues, and comes in very frequent activity on a daily basis. Besides that, the regular faces of W32/Virut.A and JS/PackRedir built on their activity from our last report period. In fact, detected activity for W32/Virut.A this period climbed to record levels, underscoring the fact that this behemoth has become a dominant threat - particularily in Asia. New to this report's top ten is W32/FakeAlert.EI - another rogue antivirus ("scareware") trojan. Scareware fraud continues to be vastly popular in the digital underground, now quite diversified since we first reported on heavy attack waves nearly one year ago in August 2008. In July we saw the emergence of SymbOS/Yxes.E and SymbOS/Yxes.F, the latest updated variants of Yxes that we first reported on in February. For further details, check out this blog post that is well worth the read: in particular, Yxes' served up dynamic content via JSP indeed shows the beginning steps as to how cyber criminals are addressing a market that is largely fragmented due to multiple platforms. This is important, because malicious binaries are often written for a single target (ie: Windows, OS/X). On traditional desktops, these targets are limited: however, in the mobile market, they are growing and diversifying. Thus, dynamically addressing which malware packages to serve up, as Yxes has done, is a technique which helps alleviate this issue and hints of what is to come in this area in the near future.
Although the active exploit rate of new vulnerabilities (Figure 1b) cooled down to 30 percent from an annual record in excess of 55 percent last report, there is still plenty to be concerned about. Most notably, two in the wild exploits were making waves this period. One is the highly discussed MS ActiveX Video control (CVE-2008-0015, FortiGuard Advisory here) first patched on July 14th by Microsoft through MS09-032. Exploit activity for this vulnerability was frequent throughout the month, but remained relatively low, with most prevalent activity detected in Korea, China and Japan. As of writing, the second mentioned vulnerability, MS Office Web Components (CVE-2009-1136, FortiGuard Advisory here) remains unpatched / zero-day, also with relatively low detection rates with leading activity in China, India and Japan. Nonetheless, it should be reminded that any successful exploit can cause significant damage; exploits against the latter (zero-days) tend to be more successful since patches are not readily available. FortiGuard IPS detects and blocks malicious activity against both of these attacks as mentioned in their respected advisories above. The FortiGuard Global Security Research team first spotted public exploit code for this second mentioned vulnerability on July 11th and immediately reported the findings.
The world of spam continues to evolve, with eCards proving to be the favored social engineering hook - especially when it comes to Canadian Pharmacy. This month, we witnessed an assault of eCard spam continuing from last month, using various techniques - a majority of them ultimately leading victims to Canadian Pharmacy's domains. These domains, automatically registered by combining two dictionary words as described in our January 2008 write-up, continue to be registered well over two years since the process began. Canadian Pharmacy's success, fueled by an affiliate sponsorship model, invites many cyber criminals to advertise the fraudulent pharmaceuticals and drive traffic to the aforementioned domains on their behalf. The net result lands rather large chunks of change in both the Canadian Pharmacy gang and affiliates' pockets. This becomes apparent through the various spam campaigns and techniques observed (as visually demonstrated in Figures 5a/5b and last month's Figure 5c). This period, the eCard spam primarily used direct links (Figure 5a), Google Groups and the photo sharing service Tinypic (Figure 5b).
While the automatic redirection used by the Google Groups campaign is not new, Tinypic is quite interesting as it serves as another example of how spam continues to reach out to emerging platforms. While traditional spam has not ceased to exist through email, we have predicted and reported on many spam attacks through new "Web 2.0" platforms such as social networking sites. To help evade detection, cyber criminals have used services such as Tinyurl in the past to obfuscate their malicious URLs. Tinypic is a similar, recent example of how legitimate service providers are commonly used nowadays to piggyback malicious resources. Regardless of the image, or what the link appears to be, always observe where any hyperlink will actually take you and exercise due care. Figure 5c illustrates the July 4th Independence Day attack utilized by Waledac in their latest wave of social engineering attacks through their growing peer to peer network of zombies. In terms of overall activity, spam rates continue to hold at high levels, while Japan jumped ahead of the USA into 2nd position for spam volume this period (Figure 4b). Out of the four threat categories sampled, traffic to web sites hosting malware remained high at a 38.7% share of total activity throughout these categories.
Solutions
Customers who use Fortinet’s FortiGuard Subscription Services should already be protected against the threats outlined in this report. Threat activity is compiled by Fortinet's FortiGuard Global Security Research Team using data gathered from its intelligence systems and FortiGate™ multi-threat security appliances in production worldwide. FortiGuard Subscription Services offer comprehensive security solutions including antivirus, intrusion prevention, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products.
