Today we released the third edition of the “2015 IBM X-Force Threat Intelligence Quarterly,” where we take a deeper look at the evolution of ransomware-as-a-service and how attackers continue to capitalize in this area. Alongside that update, the IBM Managed Security Services (MSS) group reminds us why the Dark Web is a threat for enterprises and how companies can better protect themselves. Finally, we provide a brief overview of the latest changes occurring with vulnerability tracking.
Ransomware Isn’t What It Used to Be
A quick search across the Security Intelligence site for the word ransomware will reveal a trove of recent blogs in which X-Force researchers have been informing readers about these evolving threats, which continue to net criminals millions of dollars each year.
In this third-quarter report, we discuss more of the evolution of ransomware. Not only are a surprising number of users still fooled by fake or rogue antivirus messages that are nothing more than animated Web ads designed to look like actual products, but many cybercriminals are embracing the technical sophistication required to create specialized ransomware that targets specific communities.
From Anonymity to Anarchy: Tor Network Provides Cover for Dark Dealings
The Dark Web is an unencrypted, anonymous network used by nefarious individuals and organizations to conduct illicit or illegal business, including launching attacks on corporate networks to exfiltrate valuable data.
In this report, we examine the genesis of The Onion Router (Tor) software, which enables anonymous communication as both an attack medium and an infrastructure for botnet command-and-control. The design of routing obfuscation in the Tor network provides illicit actors with additional protection for their anonymity.
We discuss various methods companies should take to block connections to the Dark Web from their networks in order to limit attack surfaces, as well as liability issues that arise from content originating from Tor nodes. This can include wholesale blocking at the firewall, IDS/IPS technology to flag attacks and developing a corporate policy to stop the creation of Tor relays or similar access nodes to the Dark Web.
Download the Q3 2015 IBM X-Force Threat Intelligence Quarterly
A Modern Scoring System to Assess the Latest Vulnerabilities
In May 2012, the Board of Directors of the Forum of Incident Response and Security Teams (FIRST) selected IBM as one of the security vendors to participate in the creation of v3 of the Common Vulnerability Scoring System (CVSS).
We highlight some of the critical changes of this updated schema and why it more accurately reflects the scope and impact of modern vulnerabilities. IBM adopted CVSS v3 in July 2015.
In the first half of 2015, we reported just over 4,000 new security vulnerabilities. If this trend continues throughout the rest of the year, the total projected vulnerabilities for 2015 would be about 8,000 — the lowest total since 2011.
For more information, download the third-quarter X-Force Threat Intelligence Quarterly or take a look at some of the other recent reports.
Senior Managing Security Consultant, X-Force, IBM