Security: PDF and Java, the most Loved, the most Targeted

Websites hosting malware are on the rise, and when people think malware they usually think of problems happening as a result of browser and email flaws and security holes.  While browser-based security exploits happen, it turns out that many of the exploits happening now are traceable to problems with client-side Java plugins and the trusted and highly popular PDF file.  In fact, less than 1 percent of all malicious attacks  were initiated by email.

A new Cisco report detailing the prevalence of malicious websites and malware found that the number of malware exploits increased in 2010 by 139 percent from the previous year.  The report saw that near the end of 2010 the frequency of malware exploits rose dramatically.  In October, the average number of exploits that attacked an organization peaked at 250 per month.

In malware that infects machines via file downloads and attachments, the PDF file format was the most frequent offender.  As many as 65 percent of all malware files were carried by PDF files.  That’s up from 52.6 percent from the previous year.  Paul Wood, Senior Analyst at MessageLabs/Symantec, said “PDF-based targeted attacks are here to stay, and are predicted to worsen as malware authors continue to innovate in the delivery, construction and obfuscation of the techniques necessary for this type of malware.”

But there appears to be an even bigger problem: client machines running old versions of the Java runtime.  Older versions of the runtime had a significant number of security issues that have since been fixed, yet client machines have not been updated yet to plug the problems.   Downloaded Java browser plugin software is being increasingly exploited.  The problem is very concerning.  While there are now a large number of PDF exploits, the number of Java-based ones is actually three and a half times greater.  Oracle is in the process of issuing 21 security patches for the Java runtime environment, and of those, 8 are classified as critical fixes.

The Cisco report does have some good news though.  It shows that the level of spam hitting people’s email inboxes declined fairly dramatically in 2010.  This was due in large part by world-wide coordinated efforts to shut down spam farm culprits.   Botnet malware for Lethic, Waledac, Mariposa and Zeus were taken down in the first quarter of 2010, followed by shutdowns of Koobface and Bredolab botnets in the fourth quarter.  At the start of 1010, on average, 380 billion spam messages were sent out daily.  By the end of 2010 the number of spam messages per day had dropped to 100 billion.  And spam continues to drop in 2011.  A security report by Symantec found that spam in February 2011 dropped by 2.2 percent.

Interestingly the report notes that the nature of spam is changing.  Historically most spam had been motivated by economic reasons — trying to sell products, but increasingly spam messages are motivated for political reasons.