Which is the most popular tactic that cybercriminals uses on their way to infect users with malicious code (malware) and generate yet another botnet?
According to a newly released report by M86 Security, that's patched vulnerabilities. Why are cybercriminals turning to the exploitation of outdated flaws in the first place? Sadly, because it works taking into consideration the average insecure 3rd party application/plugin on a sample PC. Are cybercriminals being picky? Not at all, as thanks to web malware exploitation kits such as Eleonore, Phoenix, Unique Pack, Crime Pack or Fragus, they always exploit whatever is exploitable on a targeted host.
The top 10 most observed vulnerabilities served by web malware exploitation kits:
Microsoft Internet Explorer RDS ActiveX
Office Web Components Active Script Execution
Microsoft Video Streaming (DirectShow) ActiveX Vulnerability
Microsoft Internet Explorer Deleted Object Event Handling
Microsoft Access Snapshot Viewer ActiveX Control
Adobe Reader media.newPlayer
Next to the above mentioned flaws, the report is also emphasizing the fact that, in the second half of 2010, Java-based attacks rose to higher levels than anticipated.
The trend is confirmed by a second recently released report. According to Cisco's data, the exploitation of patched Java flaws has outpaced exploitation through the use of malicious PDF files, at 6.5 percent on average for 4Q10. The increase of this exploitation technique is once again contributed to the use of specific web malware exploitation kits.