Cupertino (CA) - Home users have become the main target of blended security threats. According to report released by Symantec, the first six months of 2006 brought more than 2200 individual threats that increasingly show financial motivation and aim to extract personal and financial data, while using more elaborate techniques to evade detection.
The new report, titled "Symantec Internet Security Threat Report, Trends for January 06 - June 06," serves as one more piece of evidence that the security threats have evolved from code that once aimed especially at the deletion of certain data into a massive financially motivated criminal business.
The company said that there were 2249 new threats in the first six months of the year. The fact that home users are generally least likely to have a complete set of protection against blended attacks in place makes them a primary target: According to Symantec, 86% of all threats are aimed at home users. Instead of large and wide-spread attacks, threats have shifted to smaller, more targeted attacks focusing on fraud, data theft, and criminal activity, the security firm said.
69% of vulnerabilities targeted by criminals were seen in the area of web applications such as browsers and email clients. Web browsers are becoming more of a security concern as Microsoft's Internet Explorer (IE) experienced an increase from 25 to 38 vulnerabilities compared to the second half of 2005; Mozilla's security issues jumped from 17 to 47 and Apple Safari's from six to twelve in the same time frame.
Microsoft had the longest exposure-to-patch time in the browser industry, according to Symantec. It took Microsoft an average of nine days to issue a bug fix, while Apple published a patch within five days, Opera within two days and Mozilla within one day. The majority of attacks still aim at Microsoft: 47% were targeted at IE, 20% at Firefox and 31% at multiple browsers, Symantec said.
Microsoft, however, leads the ranking in the operating system segment: The exposure time of a Windows security issue was 13 days; Sun had the longest patch release time with 89 days followed by HP with 53 days. Apple took an average of 37 days. Red Hat matched Microsoft's time of 13 days. Symantec said that bot networks were one of the major trends in spreading spam or phishing messages, download adware and spyware, attack an organization, and harvest confidential information. The company said it identified more than 4.6 million distinct, active bot network computers and observed an average of 57,717 active bot network computers per day in the first six months of this year. 157,477 unique phishing messages were detected, showing an 81% increase over the second half of 2005. At the same time, spam made up 54% of all monitored e-mail traffic, a slight increase from 50% over the previous period.
Symantec's findings match the reports of other anti-virus specialists such as Panda Software. Panda recently reported that 94% of detected malicious code was related to cyber crime. "malware has changed its dynamic and its authors aim to drop new specimens on computers without the user realizing, while targeting their attacks at more specific objectives rather than spreading them widely," said Ryan Sherstobitoff, security spokesperson for Panda. The company said that trojans represented 64% of the malware detected in the first half of 2006. Worms represented only 4.9% of the total. Back in 2005, worms made up 40% and trojans only 26%.
