Attacks exploiting software vulnerabilities are on the rise
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-2568 | Remote Code Execution in Microsoft Windows via Malicious Shortcut (LNK) Parsing CVE-2010-2568 is an input-validation flaw (CWE-20) in how Microsoft Windows parses shortcut files, allowing malicious code to execute when the operating system merely displays the icon of a malicious shortcut (.lnk) file. Triggering requires nothing more than the Windows shell rendering the shortcut's icon — for example when browsing a folder containing the file, a vector widely abused via USB drives and network shares in incidents tied to Stuxnet and Gauss. A successful attacker gains arbitrary code execution with the privileges of the logged-on user, suitable for initial access or lateral movement. All Microsoft Windows systems as listed by CISA are affected; the provided data does not specify exact version ranges. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-09-15), carries a 91.3% EPSS probability of exploitation (100th percentile), and related headlines report Microsoft having to re-issue the fix more than once for Stuxnet-related attacks. Do: Apply Microsoft updates per vendor instructions (CISA's required action); since headlines indicate this LNK fix was re-released multiple times, verify systems carry the latest cumulative Windows updates rather than only the original patch. Until patched, avoid browsing untrusted removable drives or network shares with a shell that renders shortcut icons, and monitor for LNK-delivered malware. | — | 91% | KEV |
| mass≈1 billion+ Windows installations worldwide (unknown share unpatched; legacy versions carry the highest risk) |
Full article474 words · extracted from helpnetsecurity.com · click to collapse
Attacks conducted with the help of exploits are among the most effective as they generally do not require any user interaction, and can deliver dangerous code without arousing user suspicion.
According to data gathered by Kaspersky Lab, there were 702 million attempts to launch an exploit in 2016 – an increase of 24.54 percent from 2015. During the same period, more than 297,000 users worldwide were attacked by unknown exploits (zero-day and heavily obfuscated known exploits), an increase of just under 7 percent on 2015.
Interestingly enough, exploits to the infamous “Stuxnet vulnerability” (CVE-2010-2568) still top the list in terms of the number of attacked users – 1 in 4 users that encountered an exploit during 2016 faced this particular threat.
Overall, targeted attackers and campaigns from 2010 to 2016 made use of more than 80 vulnerabilities. Around two-thirds of these vulnerabilities were used and re-used by more than one threat actor.
Browsers, Windows OS, Android OS and Microsoft Office are the applications exploited most often – 69.8 percent of users encountered an exploit for one of these apps at least once in 2016.
Exploits: The preferred tools of cyber espionage groups
The number of corporate users attacked by exploits increased 28.35 percent to reach more than 690,000. However, despite the growing number of attacks featuring exploits, and the growing number of corporate users attacked in this way, the number of private users who encountered an exploit attack in 2016 decreased just over 20 percent – from 5.4 million in 2015 to 4.3 million in 2016.
A possible reason for this decline could be a reduction in the number of sources for exploits: 2016 saw several big and popular exploit kits (the Neutrino and Angler exploit kits) leave the underground market. This significantly affected the overall exploit threat landscape as many cybercriminal groups apparently lost their capabilities to spread the malware.
Another reason is the faster reaction time of software vendors to newly discovered security issues. As a result, it is now far more expensive for cybercriminals to develop and support a really effective exploit kit and simultaneously stay in profit. However this is not the case when it comes to attacks against organizations.
“Based on both our detection statistics and our observations of the activity of targeted attack actors, we see that professional cyber espionage groups still have the budgets and skills to develop and distribute sophisticated exploits,” said Alexander Liskin, security expert at Kaspersky Lab.
“The recent leak of malicious tools allegedly used by the Equation Group is an illustration of this. However, this doesn’t mean that it is impossible to protect your organization against exploit-based attacks. In order not to let malicious actors succeed, we advise users, especially corporate ones, to implement best practices of internet security and protect their computers, mobile devices and networks with proven and effective protection tools.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/04/21/attack-exploits/