TrendLabs 2012 Annual Security Roundup: Evolved Threats in a “Post-PC” World

Trend.Micro.incorporated
.....................2012.ANNUAL.SeCURiTY.ROUNDUP

evolved.Threats.in.a.“Post-PC”.World

Mobile..................................................................................................... 2
.
Android malware followed the footsteps of Windows threats in
terms of history, but at a much faster rate.
Targeted Attacks and Data Breaches............................................... 4
Data breaches have become typical. Threat actors closely respond
to their target’s environment by using both old and new tools and
techniques.
Cybercrime............................................................................................ 7
.
Threats evolved to become more effective and platform-agnostic,
responding to the changing digital landscape.
Software Vulnerabilities...................................................................... 11
Java exploits were seen, along with several zero-days for other
programs.
Social Media and Online Services. ...................................................13
.
Social media threats flatlined in terms of creative use of
technology, privacy concerns made headlines, and cloud services
were abused by the bad guys.

Experts have been predicting the coming “post PC” era for a few
years. So the question has been, “when will we know that it’s
really here?” A simple answer is, we’ll know it’s really here when
cybercriminals move beyond the PC. By that measure, 2012 is truly
the year we entered the post-PC era as cybercriminals moved to
embrace Android, social media platforms, and even Macs with their
attacks.
Most notable for 2012 is that it took Android less than three years to
reach the volume of malware threats that it took 14 years for the PC
to reach. If that wasn’t enough proof, attackers moved their tried-
and-true attacks to social media platforms like Pinterest and Tumblr
for a broader reach. Attackers have even embraced social media for
command and control, opting for Twitter over IRC in some cases.
In seeking out vulnerabilities to attack, attackers continued this
trend by focusing on a technology whose very name is synonymous
with multiplatform development—Java. 2012 was the year when Java
supplanted pure Windows-based threats in the attackers’ crosshairs
leading, among other things, to the first widespread attack against
Macs.
Beyond this move away from the PC, 2012 saw attackers focus on
refining their attacks and adopting more professional software
development practices rather than introducing new attack means.
The Black Hole Exploit Kit, automatic transfer systems (ATSs), and
ransomware were all refined and improved in ways that would make
any commercial software vendor proud.
Most worrisome for enterprises and organizations though is that
data breaches and targeted attacks continued at an alarming rate
with staggering consequences. In one incident alone—the Global
Payments data breach—the cost has already reached US$94 million
and is still climbing. Targeted attacks are being helped along by the
“children of Stuxnet”—attack code and kits like Flame, Duqu, and
Gauss that were derived from the Stuxnet attack of three years ago.
Overall, 2012 unfolded much like our chief technology officer,
Raimund Genes, predicted in our “12 Security Predictions for 2012,”
particularly around post-PC threats—the sophistication of attacks
and targeted attacks. As he noted then, “our hope that new OSs
make the world a safer place didn’t work out.” 2012 has clearly
shown that to be the case. The post-PC era is here—and it’s already
looking to be a more dangerous era with higher stakes at risk.

1

Growth.of.Android.OS.Threats
Like PC Malware but Faster
2012 erased any doubt that the “services” that add to their bills. For Android, it is no longer a case
malware threat for mobile devices Second, we saw many high-risk of directly installing malicious
is real. The number of Android apps, which violate user privacy by apps in smartphones. Now, URLs
malware shot up from 1,000 at the acquiring sensitive data without are able to either wipe data from
start of the year to 350,000 by asking for explicit consent. phones2 or take over devices.3
year’s end. Smartphones are now facing the
Android is well on its way to
same kinds of threats previously
This explosive malware growth becoming the Windows of the
seen on their PC cousins, all in
mirrors the growth of the Android mobile space. The popularity of
roughly three years.
OS itself. IDC estimates that Windows means that it has faced
as many as three-fourths of all the lion’s share of desktop threats TrendLabsSM also released the
smartphones shipped in the third for years. Similarly, the large “2012 Annual Mobile Threat and
quarter ran the Android OS.1 Since Android market was the target of Security Roundup: Repeating
cybercriminals go after the most most mobile threats, but their rate History,” which goes into more
commonly used OS, Android has of volume growth and complexity detail about the mobile threat
attracted the bulk of cybercriminal swelled at a much faster pace landscape last year.
attention on mobile platforms to compared with PC malware.
date.
Two major mobile malware Android.was.the.target.of.most.mobile.
types dominated 2012. First, we threats,.but.their.rate.of.volume.growth.and.
saw premium service abusers,
complexity.swelled.at.a.much.faster.pace.
which subscribe users to various
compared.with.PC.malware.

We’ve seen the same kinds of threats in the early web threat days of PC malware
appear in the Android malware landscape—all in roughly three years.

2

The staggering increase in the Android malware More than 70% of all Android malware belongs to a few
volume was partially due to the volume of malware families, most of which were either premium
premium service abusers and high-risk apps service abusers or high-risk apps.
seen in the latter months of 2012.

It took Android less than 3 years to reach 350,000 malware while it
took PC malware 14 years to reach the same volume of threats.
3

Data Breaches and APT Campaigns
The New Normal
2012 saw the continuation of the organizations and companies. seen remote access Trojans
previous year’s pattern of data Among the campaigns we (RATs) like PoisonIvy, PlugX,
breaches and targeted attacks. closely investigated were LURID, Xtreme, JACKSBOT, and DRAT
Payment processing company, Luckycat, Taidoor, and IXESHE. used in targeted attacks. These
Global Payments;4 the South We observed that attackers were readily available RATs, including
Carolina Department of Revenue;5 good at “customizing” attacks unsophisticated ones, made it
and online shoe store, Zappos,6 as necessary—threat actors were easier for threat actors to carry
for instance, all suffered breaches able to use the attack vector most out targeted attacks.
that affected millions of users suitable to their purposes.
We also saw indications that
and had a considerable financial
Spear-phishing emails were still mobile devices were becoming of
impact. In the case of the Global
the primary means of delivering interest to threat actors. Mobile
Payments breach, the expenses
malware in targeted attacks. malware with information theft
reached US$94 million. The
Stealth and persistence were capabilities—similar to those used
question is no longer if a system
achieved through a wide variety in a targeted attack—were found
will suffer a security breach, but
of means, making network on servers related to the Luckycat
when.
traffic analysis critical for campaign.7
Despite heightened awareness security defenders. We have
of APTs and targeted attacks,
we have seen several ongoing
campaigns against various
The question is no longer if a system will
suffer a security breach, but when.

• An experiment found that 87% of organizations clicked a link related to a social engineering lure.
• Targets of the Luckycat campaign included those in the aerospace, energy, military research, engineering,
and shipping industries and Tibetan activists.
• A modified version of ENFAL—a malware used in the Lurid campaign—was able to compromise 874
computers in 33 countries in 2012..
• A survey found that 67% of organizations believed their security activities weren’t enough to stop
advanced persistent threats (APTs) or hackers.
• The IXESHE campaign has been actively staging targeted attacks since at least July 2009.
• The first stage of launching an APT campaign is intelligence gathering.

4

Attackers still largely used emails, the most popular mode of business communication, to
get in to target networks. DreamMail is an email client that supports several protocols,
including SMTP, eSMTP, POP3, Hotmail, and Yahoo and a remote mailbox access function.

Threat actors used a mix of old—up to three-year-old—and relatively new vulnerabilities.

5

Rich Text Format (.RTF) files were the most common kind of files used in targeted attacks,
Microsoft® Excel® files, a close second. However, this data does not entirely reflect the actual
vulnerabilities used, as it is relatively easy to embed different kinds of exploits into different file types.

The diagram above shows the connections between the heavily
reported malware said to have close ties with Stuxnet.
6

Cybercrime
Fine-Tuning Attack Methods
Cybercriminals continued to funds from the victims’ to the Taken together, these three
enhance and improve their tools cybercriminals’ accounts.8 This developments represent an
in 2012. The three most notable makes fraud more difficult to evolutionary upgrade to existing
developments in the year had to detect on the part of banks, as the threats, demonstrating how
do with ransomware, ATSs, and the transaction appears to be made malware development has become
Blackhole Exploit Kit. by the user and not a potentially increasingly professional in rigor,
fraudulent third party. By contrast, discipline, and methodology. None
Ransomware have been a problem
traditional banking malware of the developments constituted
for some time, but 2012 saw a
require human intervention to a completely new threat, but
particular tactic that came into
transfer funds, which is a slower the updated versions appeared
common usage. Ransomware
process and may easily be more dangerous in the threat
claimed that law enforcement
detected by banks. environment.
groups “suspended” users’
systems due to violations of The Blackhole Exploit Kit spent This doesn’t mean that the rest of
the law. In order to unlock their 2012 in the limelight, as it was the threat landscape was stagnant.
computers, users had to pay a fine utilized in a number of phishing 2012 saw the significant rise of the
using online vouchers. campaigns. It saw a major upgrade ZeroAccess malware family10 while
in the second half of the year major file infectors like XPAJ11 and
Ransomware can be considered
with the release of version 2.0 in VOBFUS12 returned to prominence.
the successor of fake antivirus
the underground—a response to Our analysis of the Chinese13 and
malware as the leading cybercrime
increased security vendor efforts Russian14 underground economies
threat facing consumers. Both
to shut down 1.x versions.9 These revealed that the business of
threats cause users to worry about
phishing campaigns also changed stealing information like email and
something (i.e., losing important
the way phishing was conducted— social networking account logins,
data or downloading malicious
subtle emails made it difficult even credit card numbers, and personal
files) and asks them to pay up to
for tech-savvy users to distinguish data remains as brisk as ever.
make the “problem” go away.
real from fake messages.
Similarly, ATSs became a key
threat facing smaller businesses.
ATSs remove middlemen, usually None of the developments constituted a
a keylogger or a WebInject file,
when siphoning funds. Instead of completely new threat, but the updated
passively stealing information, versions appeared more dangerous in the
ATSs automatically transfer threat environment.

7

The DOWNAD worm has been around since 2008, spreading throughout networks using a now-patched vulnerability in
Microsoft’s Server Service. ZeroAccess piggybacks on cracked applications or poses as a required codec in peer-to-peer
(P2P) applications. Crack or keygen programs generate serial numbers to enable the use of pirated applications.

Domain Reason

trafficconverter.biz Distributes malware, particularly DOWNAD variants

info.ejianlong.com Downloads malware

deepspacer.com Hosts malicious URLs, the registrant of which is a known spammer

mmi.explabs.net Page DROPPER Trojans request access to

www . funad . co . kr Poses security risks for compromised systems and/or networks

www . trafficholder . com Traffic site known for distributing malware

Associated with the proliferation of pirated applications and other
serw.clicksor.com threats; posts annoying pop-up messages

install.ticno.com Engaged in malware distribution

172.168.6.21 Distributes X97M_LAROUX.BK, XF_HELPOPY.AW, XF_NETSNAKE.A,
X97M_LAROUX.CO, and X97M_LAROUX.CE

The proliferation of DOWNAD malware was partially aided by malware-hosting URLs. Some of these,
however, are not necessarily malicious but have been compromised to perform malicious routines.

8

Almost all spam are still written in India was the top spam-sending country in 2012
English, similar to previous years. while Saudi Arabia sent the most number of
spam in the third quarter.

Blackhole Exploit Kit URLs related to renewed phishing
attacks were a primary contributor to the resurgence of
the phishing URL volume in 2012 after dipping in 2011.

More than 20% of the malicious URLs identified in 2012
were hosted in the United States or used hosting
services located in the same region.

9

The Blackhole Exploit Kit has changed the way phishing attacks are carried out. ATSs, meanwhile, have seen
developments compared with traditional banking Trojans that made them prominent in 2012.

Ransomware Developments

Ransomware infections increased
throughout 2012.
Ransomware have changed throughout the years.

10

Vulnerabilities
Old but Reliable Exploits and Some Zero-Days
Zero-day vulnerabilities continued three-year-old vulnerability, CVE- Acrobat and Reader’s improved
to affect users in 2012. In August, 2009-3129 or MS09-067, was the sandboxing feature with the
the Blackhole Exploit Kit15 made third most exploited vulnerability release of version 11.25 Adobe Flash
use of a zero-day vulnerability in targeted attacks in April 2012.23 Player received a new background
in Java 7.16 In September, a zero- updater26 to help users who still
An exploit kit—a combination of
day use-after-free vulnerability in run older versions. Browsers
exploits designed to compromise
Internet Explorer17 was patched, received constant updates
a user’s computer—is a key part
but was previously used in attacks throughout the year to patch
of today’s threat environment.
that led to RATs.18 Just before existing holes and strengthen their
One of the most prominent exploit
the year ended, older versions defenses against exploits.
kits today is the Blackhole Exploit
of the browser were found
Kit, which is commonly used in Java, however, has not seen a
with another zero-day flaw.19
phishing campaigns to target similar development. Instead,
Taking a peek ahead this year,
computers.24 there have been moves to reduce
we saw yet another Java zero-
the use of Java. Apple went so far
day vulnerability abused by the The applications most targeted
as to remove Java from browsers
Blackhole Exploit Kit.20 by exploit kits are browsers
on OS X computers.27 A December
or technologies that expose
Attackers did not need to seek update to Java allowed users to
functionality through browser
out new vulnerabilities, as most disable Java content in browsers.28
plug-ins, particularly Internet
users failed to patch their systems
Explorer; Adobe Acrobat, Reader, The relatively unsecured state of
anyway, which means that old
and Flash Player; and Java. Java, combined with its popularity
vulnerabilities still worked.
However, developers have taken with users, resulted in growth in its
The VOBFUS worm, which hit
steps to make the bugs in their popularity among cybercriminals.
a number of computers in the
products more difficult to exploit.
latter part of 2012, uses the
For example, Adobe highlighted
same vulnerability that Stuxnet
originally used as far back as
2010.21 Targeted attacks are known
The relatively unsecured state of Java,
to make use of vulnerabilities in combined with its popularity with users,
Microsoft® Office® applications resulted in growth in its popularity among
that date back to 2009.22 In fact, a cybercriminals.

11

Of the vulnerabilities addressed in 2012, the majority were rated “medium” (4.0 to 6.9) in
severity while a third were given a “high” (7.0 to 10.0) severity rating.

The majority of browser exploits we monitored in 2012
came from the Blackhole Exploit Kit 1.0, while a third came
from RedKit. Java was the most targeted program by exploit kits
based on the browser exploits we monitored.
12

Social.Media.and.Online.Services
Recycled Threats
While social media threats did not whether or not users trusted their Pastebin saw much use as a
change much in 2012, attackers social networks came up again31 dumping ground for all sorts of
did not remain idle in exploiting and again32 in 2012. stolen information. Blog comments
new opportunities. and Twitter accounts became
In addition, users continued to
common means to control botnets,
In 2012, Pinterest29 and Tumblr30 inadvertently share confidential
as an alternative to central
became popular among users information online. They
command-and-control servers,
and attracted the attention of posted their credit card details
which can be found and blocked
various scammers. As expected, and IDs without realizing the
far more easily than legitimate
cybercriminals go where the consequences of doing so.
services.
audience is, so malicious links in Unfortunately, these incidents
Pinterest and Tumblr pointed to just represent the worst case of
survey scams. oversharing online.33
However, much of the discussion Legitimate online services
surrounding social media has been were also used with increasing
about privacy. Decisions made frequency for malicious purposes.
by social networking sites about
user privacy called into question Decisions.made.by.social.networking.sites.
how these sites handle personal
information. The question of about.user.privacy.called.into.question.how.
these.sites.handle.personal.information.

The switch from basic IRC to other new tools for command and control is one example
of how cybercriminals abuse legitimate online services for their own operations.

13

Cybercriminals used all kinds of lures to reel in victims throughout 2012.

14

What This Means for Users and Businesses
Mobile Threats
For Home Users
• Use your smartphone’s built-in security features.
• Avoid using free but unsecured Wi-Fi access.
• Scrutinize every app you download regardless of source.
• Understand permissions before accepting them.
• Consider investing in a mobile security app for Android like Trend Micro™ Mobile Security Personal
Edition.
For Security Groups
On top of educating employees on consumer tips to secure their mobile devices, enterprises should embrace
consumerization via this three-step plan with the help of mobile device management and security products
like Trend Micro™ Mobile Security:
• Step 1: Have a plan.
• Step 2: Say yes… but not to everything… and not to everyone.
• Step 3: Put the right infrastructure in place.

Targeted Attacks and Data Breaches
For Home Users
Enterprises and organizations are the common targets of APTs and highly targeted attacks. But attacks often
enter target networks via employee inboxes in the form of spear-phishing emails. Employees must delete or
ignore emails from unknown sources.
For Security Groups
• Develop local and external threat intelligence.
• Test and educate employees against social engineering attacks.
• Formulate mitigation and cleanup strategies in case of an attack.
• Deploy custom defense solutions like Trend Micro™ Deep Discovery to protect against APTs.
• Protect company data through data protection and management solutions.

15

Cybercrime
For Home Users
• Regularly check your bank, credit, and debit card statements to ensure that all of the transactions in them
are legitimate.
• When conducting financial transactions online, make sure the website address contains an s as in
https // ww ank om.
: w .b .c
• Invest in a comprehensive security suite like Trend Micro™ Titanium Security.
For Security Groups
• Install effective security solutions in computers or devices that contain or have access to sensitive
information.
• Deploy a defense-in-depth security practice.
• Block threats at their source using web, IP, and domain reputation technologies.
• Invest in sandbox technologies to identify advanced malware.

Software Vulnerabilities
For Home Users
• Apply the latest security updates and patches to your software programs and OSs.
• Enable automatic updates where possible.
For Security Groups
Deploy solutions that allow vulnerability shielding to help immediately protect networks from exploits like
Trend Micro™ Deep Security.

Social Media Threats
For Home Users
• Use random but memorable phrases as passwords.
• Avoid using the same password across online accounts.
• Change your password every few months.
• Consider using password managers like Trend Micro™ DirectPass™.
• A good rule of thumb on giving out information on social networking sites is to ask, “Would I give this
information to a stranger over the phone?”
For Security Groups
• Monitor employees’ social networking usage.
• Create easy-to-follow guidelines on social media use regarding sharing of information and representing
your company’s brand and image.
• Clearly define what’s confidential.

16

References
1 http://www.idc.com/getdoc.jsp?containerId=prUS23771812
2 http://blog.trendmicro.com/trendlabs-security-intelligence/dirty-ussds-and-the-
android-update-problem/
3 http://blog.trendmicro.com/trendlabs-security-intelligence/exynos-based-android-
devices-suffer-from-vulnerability/
4 http://money.cnn.com/2012/04/02/technology/global-payments-breach/index.htm
5 http://www.forbes.com/sites/anthonykosner/2012/10/27/cyber-security-fails-as-3-6-
million-social-security-numbers-breached-in-south-carolina/
6 http://news.cnet.com/8301-1009_3-57359536-83/zappos-customer-data-accessed-
in-security-breach/
7 http://blog.trendmicro.com/trendlabs-security-intelligence/defcon-2012-android-
malware-in-luckycat-servers/
8 http://blog.trendmicro.com/trendlabs-security-intelligence/evolved-banking-fraud-
malware-automatic-transfer-systems/
9 http://blog.trendmicro.com/trendlabs-security-intelligence/blackhole-2-0-beta-
tests-in-the-wild/
10 http://blog.trendmicro.com/trendlabs-security-intelligence/under-the-hood-of-
bkdr_zaccess/
11 http://blog.trendmicro.com/trendlabs-security-intelligence/pe_xpaj-persistent-file-
infector/
12 http://blog.trendmicro.com/trendlabs-security-intelligence/watch-out-for-worm_
vobfus/
13 http://blog.trendmicro.com/trendlabs-security-intelligence/the-chinese-
underground-part-1-introduction/
14 http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-russian-
underground/
15 http://blog.trendmicro.com/trendlabs-security-intelligence/java-zero-days-and-the-
blackhole-exploit-kit/
16 http://blog.trendmicro.com/trendlabs-security-intelligence/java-runtime-
environment-1-7-zero-day-exploit-delivers-backdoor/
17 http://blog.trendmicro.com/trendlabs-security-intelligence/microsoft-releases-out-
of-cycle-patch-for-ie/
18 http://blog.trendmicro.com/trendlabs-security-intelligence/new-ie-zero-day-exploit-
leads-to-poisonivy
19 http://blog.trendmicro.com/trendlabs-security-intelligence/why-is-the-watering-
hole-technique-effective/
20 http://blog.trendmicro.com/trendlabs-security-intelligence/java-zero-day-exploit-
and-ruby-on-rails-vulnerabilities/
21 http://technet.microsoft.com/en-us/security/bulletin/MS10-046
22 http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2012-0158-
exploitation-seen-in-various-global-campaigns/
23 http://blog.trendmicro.com/trendlabs-security-intelligence/snapshot-of-exploit-
documents-for-april-2012/
24 http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-
papers/wp_blackhole-exploit-kit.pdf
25 http://blogs.adobe.com/asset/2012/10/new-security-capabilities-in-adobe-reader-
and-acrobat-xi-now-available.html
26 http://blogs.adobe.com/asset/2012/03/an-update-for-the-flash-player-updater.html
27 http://arstechnica.com/apple/2012/10/apple-removes-java-from-all-os-x-web-
browsers/
28 http://www.infoworld.com/d/security/java-7-update-10-allows-users-restrict-java-in-
browsers-209423
29 http://blog.trendmicro.com/trendlabs-security-intelligence/survey-scams-find-their-
way-into-pinterest/
30 http://blog.trendmicro.com/trendlabs-security-intelligence/tumviewer-and-online-
income-survey-scams-hit-tumblr/
31 http://blog.trendmicro.com/trendlabs-security-intelligence/infographic-public-or-
private-the-risks-of-posting-in-social-networks/
32 http://blog.trendmicro.com/trendlabs-security-intelligence/privacy-worries-hound-
facebook-yet-again/
33 http://blog.trendmicro.com/trendlabs-security-intelligence/the-dangers-of-posting-
credit-cards-ids-on-instagram-and-twitter/

Trend Micro Incorporated TrendLABSSM
Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cloud TrendLabs is a multinational research, development, and support
security leader, creates a world safe for exchanging digital information center with an extensive regional presence committed to 24x7 threat
with its Internet content security and threat management solutions surveillance, attack prevention, and timely and seamless solutions
for businesses and consumers. A pioneer in server security with delivery. With more than 1,000 threat experts and support engineers
over 20 years’ experience, we deliver top-ranked client, server and deployed round-the-clock in labs located around the globe, TrendLabs
cloud-based security that fits our customers’ and partners’ needs, enables Trend Micro to continuously monitor the threat landscape
stops new threats faster, and protects data in physical, virtualized and across the globe; deliver real-time data to detect, to preempt, and to
cloud environments. Powered by the industry-leading Trend Micro™ eliminate threats; research on and analyze technologies to combat
Smart Protection Network™ cloud computing security infrastructure, new threats; respond in real time to targeted threats; and help
our products and services stop threats where they emerge—from the customers worldwide minimize damage, reduce costs, and ensure
Internet. They are supported by 1,000+ threat intelligence experts business continuity.
around the globe.

©2013 by Trend Micro Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks of Trend
Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners.

TrendLabs 2012 Annual Security Roundup: Evolved Threats in a “Post-PC” World

More Related Content

What's hot (20)

Similar to TrendLabs 2012 Annual Security Roundup: Evolved Threats in a “Post-PC” World (20)

Recently uploaded (20)

TrendLabs 2012 Annual Security Roundup: Evolved Threats in a “Post-PC” World