Cybercriminals helped by unpatched systems: Fortinet

Chow.

Gavin Chow, Network Security Strategist, Fortinet APAC, presented the top threats for Singapore in 1H16 at the Fortinet Security 361° symposium held in Singapore recently.

Source: Fortinet.

The number of threats continues to grow. A snapshot taken on 2 September showed that there were 441 instances of zero-day malware in the last 24 hours, against 3,852 in the last week and 14,203 in the last month, Chow shared. 'Zero-day' describes malware which have not been discovered before, such that security vendors have had 'zero days' to create a signature that can be used to identify the malware and prevent a device from installing the malware.

Globally, the top three malware for 1H16 are Prosiak, Ramnit and Cain. In Singapore, the No. 1 malware is Nemucod. Agent is in second and ninth place. All other places in the top 10 are occupied by different variants of Nemucod. Conficker is the No.1 botnet in Singapore for the same period, followed by Andromeda and then Pushdo. H-worm is in 4th place. Globally, it is Andromeda, Zero Access and H-worm, with Conficker in 4th place.

The top vulnerability for intrusion prevention systems (IPS) in Singapore has to do with NTP, Chow revealed, as a result of older versions of NTP software being in use. NTP is one of the oldest network protocols in use, making older versions of it relatively insecure. This is followed by Windows server information spoofing, and then Cisco-related IPv4 denial of service attacks. Globally, the top three vulnerabilities are Windows server spoofing, NTP, and SIP in that order.

The top 10 mobile malware in Singapore for 1H16 includes adware, with the potential to cause more problems than traditional malware, and all of it targets the Android operating system. Android also dominates in the mobile malware top 10 list globally. "The mobile device hosts even more information than the PC," said Chow. "It know where you're going, you have two-factor authentication software tokens in the phone."

Chow added that rooted phones can be exposed to malware on phones, both globally and in the Singapore perspective. Those who know what they are doing and are able to secure their phones might escape malware, but the uninitiated are likely to open themselves to malware, he said.

For ransomware, Locky which came out in February 2016, is No. 1 in Singapore, Chow said.

Top ransomware globally (left) and in Singapore (right) for 1H16.

Chow added that Singapore companies should guard against OpenSSL threats and to patch their systems against Heartbleed, as Fortinet still sees successful penetration via both vulnerabilities. "Cyber threats continue to evolve. Our telemetry shows that they will not stop anytime soon," he said.

Interested?

Subscribe to the weekly FortiGuard Intelligence Brief. Threat intelligence can help smaller companies identify 'indicators of compromise' that they can blacklist via their routers and firewalls, whereas larger companies with their own IT teams can correlate external data feeds with internal data to identify and mitigate attacks. 

Read research papers, zero day research, and disclosed advisories from FortiGuard Labs researchers

Read the other TechTrade Asia blog posts from the Fortinet Security 361° symposium in Singapore:

The reality of ransomware and Wi-Fi spoofing
Practical steps to cyber resiliency

posted from Bloggeroid