Report: Patched vulnerabilities remain prime exploitation vector

Report: Patched vulnerabilities remain prime exploitation vector

Summary: Two reports highlight the fact that outdated and already patched vulnerabilities remain the prime exploitation vector for malicious attackers and cybercriminals in general.

SHARE:
TOPICS: Malware, Security
22

Which is the most popular tactic that cybercriminals uses on their way to infect users with malicious code (malware) and generate yet another botnet?

According to a newly released report by M86 Security, that's patched vulnerabilities. Why are cybercriminals turning to the exploitation of outdated flaws in the first place? Sadly, because it works taking into consideration the average insecure 3rd party application/plugin on a sample PC. Are cybercriminals being picky? Not at all, as thanks to web malware exploitation kits such as Eleonore, Phoenix, Unique Pack, Crime Pack or Fragus, they always exploit whatever is exploitable on a targeted host.

The top 10 most observed vulnerabilities served by web malware exploitation kits:

  • Microsoft Internet Explorer RDS ActiveX
  • Office Web Components Active Script Execution
  • Microsoft Video Streaming (DirectShow) ActiveX Vulnerability
  • Real Player IERPCtl Remote Code Execution
  • Adobe Acrobat and Adobe Reader CollectEmailInfo
  • Adobe Reader GetIcon JavaScript Method Buffer Overflow
  • Adobe Reader util.printf() JavaScript Func() Stack Overflow
  • Microsoft Internet Explorer Deleted Object Event Handling
  • Microsoft Access Snapshot Viewer ActiveX Control
  • Adobe Reader media.newPlayer

Next to the above mentioned flaws, the report is also emphasizing the fact that, in the second half of 2010, Java-based attacks rose to higher levels than anticipated.

The trend is confirmed by a second recently released report. According to Cisco's data, the exploitation of patched Java flaws has outpaced exploitation through the use of malicious PDF files, at 6.5 percent on average for 4Q10. The increase of this exploitation technique is once again contributed to the use of specific web malware exploitation kits.

See also:

Users are advised to use least privilege accounts, browse the web in isolated environment, and ensure their hosts are free of outdated 3rd party software, browser plugins or OS-specific flaws.

Topics: Malware, Security

Dancho Danchev

About Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

22 comments
Log in or register to join the discussion
  • No surprise here.

    This has been common for the past decade. Several very successful exploits took advantage of patched vulnerabilities. Which is why I recommend, barring some specific reason, always applying patches.
    ye
    • You hear that, folks?

      @ye says to leave your systems unpatched. lol...
      LTV10
      • Reading comprehension fails you.

        @LTV10: [i]ye says to leave your systems unpatched.[/i]

        Where did I say that?
        ye
      • RE: Report: Patched vulnerabilities remain prime exploitation vector

        @LTV10
        no you read that wrong he said always patch unless there is some specific circumstance where you can't or shouldn't (i.e. broken patch that may do more harm than good)
        KBot
      • You left an opening

        You said...

        [i]Which is why I recommend, barring some specific reason, always applying patches.[/i]

        Which tells me some patches shouldn't be installed. Which means your system isn't fully patched.

        Now if the patch was bad, then why would Micro$oft release it in the first place? They're always right, ya know. ;)
        LTV10
      • You're grasping at straws.

        @LTV10: [I]Which tells me some patches shouldn't be installed. Which means your system isn't fully patched.[/I]

        That or you're stupid as it means no such thing.
        ye
      • Answer my question

        You can't because you know I'm right.
        LTV10
  • Stop worring about viruses, spyware and botnets...

    Get a Mac.
    HollywoodDog
    • I don't worry about viruses, spyware and botnets.

      @HollywoodDog: And I primarily use Windows. Haven't been concerned with it for well over a decade.
      ye
      • RE: Report: Patched vulnerabilities remain prime exploitation vector

        @ye I agree!! I also recommend Secundia PSI to help with all your programs
        bvonr
      • Of course not - lol

        [i]* Microsoft Internet Explorer RDS ActiveX
        * Office Web Components Active Script Execution
        * Microsoft Video Streaming (DirectShow) ActiveX Vulnerability
        * Real Player IERPCtl Remote Code Execution
        * Adobe Acrobat and Adobe Reader CollectEmailInfo
        * Adobe Reader GetIcon JavaScript Method Buffer Overflow
        * Adobe Reader util.printf() JavaScript Func() Stack Overflow
        * Microsoft Internet Explorer Deleted Object Event Handling
        * Microsoft Access Snapshot Viewer ActiveX Control
        * Adobe Reader media.newPlayer[/i]

        And not one single attack vector for Linux. [b]Not one.[/b]

        :)
        LTV10
    • RE: Report: Patched vulnerabilities remain prime exploitation vector

      @HollywoodDog
      obscurity isn't a solution expecially considered Apple's recent advancements in the mobile market.
      KBot
  • RE: Report: Patched vulnerabilities remain prime exploitation vector

    Uh, the report is stating that too many users/programmers have NOT applied patches, but think they are invulnerable because they patched ONE vulnerable piece of software. If you have 3 pieces of software that all use the Mozilla framework and only patch one of them (like, oh say, FireFox?), the other two apps are still vulnerable.
    RyuDarragh
  • Users fear installs and updates.

    Unfortunately, you can blame malware and long wizards for making users afraid of updates. I know lots of regular users that just wait for their local techie neighbor every 6 months or so to patch up their system.

    The only real solution IMO is for software developers to start using update systems like what Google Chrome uses: Transparent, automatic, and don't ask the users any questions. Just install the update.

    Whenever I set up a system for a user that isn't tech savvy, I always make sure Windows is set to update automatically, and if I'm allowed to, I install the newest Secunia PSI, which has the ability to install many application updates automatically.

    Sadly, not all applications have the ability to have silent, automatic updates, but whenever possible I enable them.

    It's less work for myself and my users if updates are automatic. And to be honest, it's how things are going to work in the future.

    While it's certainly good to allow some users to set updates to manual if there are compatibility issues - I think that by default, they should be automatic on all software, and I think that all non-web software should embrace the update model that Google Chrome uses.
    CobraA1
    • Agreed. And while they're at it they can also remove the license agreement.

      @CobraA1: Why does a patch require agreement to license terms?
      ye
      • RE: Report: Patched vulnerabilities remain prime exploitation vector

        @ye 'cause as much as we'd like, we can't get rid of lawyers . . .

        If something really needs to show new license terms, I'd say put it into a non-intrusive element in the app, like a sidebar or something when the app is launched for the first time after an update. Or something like those yellow bars in browsers, offering you the chance to read it if you want or something.

        Something [i]besides[/i] inside an install wizard. It's time for the wizards to go away IMO.
        CobraA1
      • I fail to see the need for a license agreement with a patch.

        @CobraA1: The patch should be licensed under the terms of the software it applies to. No need for an additional license acceptance.
        ye
      • RE: Report: Patched vulnerabilities remain prime exploitation vector

        <i>Something besides inside an install wizard. It's time for the wizards to go away IMO.</i>
        ~CobraA1

        I oughta sell this old twelve string then..
        catseverywhere
  • RE: Report: Patched vulnerabilities remain prime exploitation vector

    I have removed Firefox from my computers because I found it impossible to keep the plugins up to date.
    langle
    • That's pretty sad

      Which means you don't know how to update Firefox properly.
      LTV10