we protect your digital worlds Global Threat Report 2007 Sales Hotline: (852) 2893 8860 www.eset.comwww.eset.hk ESET Global Threat Report for 2007 1 As another year draws to a close, few can have failed to notice the plagues of malicious software, floods of fraudulent emails and the generally increased pestilence of our online world, marking out 2007 as one of the most remarkable in the history of malware. Since ESET was founded in 1992, all sorts of threats have appeared, evolved, and in some cases disappeared again. 2007 was no exception, and as a company, we’ve had to grow and evolve to find innovative ways to meet those threats. To tie up what was an exciting year - perhaps too exciting in some ways - we’ve taken a look back to consider the trials and triumphs of the past months. ESET has a unique store of data to mine, gathered through our ThreatSense.Net® technology, which automatically collects data about malware threats, and particularly about newly-discovered, heuristically detected threats. Information is constantly fed back from our customers (with their explicit consent of course!) to our Threat Laboratory, enabling us to recognize new threats instantly and gather statistics on the effectiveness of our detection, and so to get a ‘real-world’ view of the evolving threatscape. Not only does ThreatSense.Net allow us to constantly improve our products through analysis of the data, leading to enhanced detection, but it allows us to share our view of the year’s trends and developments with the wider world. There is no prize for guessing that the year ahead of us will be another challenging one. One clear trend is that more and more people are realizing that proactive detection of malware, when dealing with the huge volumes and rapid spread that we see today, is an essential component of a defense strategy. At ESET we know that simply predicting and following trends is not enough to ensure the protection of our customers, and we will continue to pursue our core values, staying ahead of the curve by the consistency of our technological innovation. As successful pioneers of heuristic techniques, you can be sure that we’ll be looking to ensure that we can meet the challenge of the unpredictable! As you read this report, bear in mind that the information is not only limited to ESET’s own unique view, but also reflects what has happened globally over the past twelve months. As with stocks and shares, past threat trends are not a sure predictor of future developments: however, we can be certain of one thing. Although the threats may change and new ones will appear, there will continue to be malicious software threats as long as there are computers to attack and exploit, and computer users to fall victim. Furthermore, as more platforms become mainstream, they will inevitably be used as a medium for exploitation. It’s worth remembering that many malware threats exploit the user, rather than a particular platform, Phishing, for instance, is not unique to a single operating system environment. We hope that you find this report interesting reading and we would love to hear from you with feedback on this report. Please write to [email protected] We wish you a safe journey through 2008, rest assured, we will be doing all we can to protect your digital worlds. The ESET Research Team Sales1-866-343-ESET Hotline: (852) (3738)2893 8860 www.eset.comwww.eset.hk 2 Table of Contents Page Introduction and Overview 3 Top Ten Email-Borne Threats 4 Figure 1: Relative Proportions of the Top Ten E-mail-Borne Threats 4 Table 1: What the Names Mean 5 Proportion of Infected E-mails to Total Messages Monitored 5 Threat Descriptions 6 • Win32/Stration 6 • “Probably unknown NewHeur_PE virus” 6 • Win32/Netsky.Q 6 • Win32/Nuwar.gen 6 • Win32/Fuclip 7 • Win32/Nuwar 7 Figure 2: Top 10 Virus Radar Listings by Detection Type 8 2007 Threat Trend Summary 9 • Malware Top 10 for January 2007 10 • Other Events in January 12 • Malware Top 10 for February 2007 13 • Other Events in February 13 • Malware Top 10 for March 2007 14 • Other Events in March 14 • Malware Top 10 for April 2007 15 • Other Events in April 16 • Malware Top 10 for May 2007 17 • Other Events in May 17 • Malware Top 10 for June 2007 18 • Other Events in June 18 • Malware Top 10 for July 2007 20 • Other Events in July 20 • Malware Top 10 for August 2007 21 • Other Events in August 21 • Malware Top 10 for September 2007 22 • Other Events in September 23 • Malware Top 10 for October 2007 24 • Other Events in October 25 • Malware Top 10 for November 2007 26 • Other Events in November 26 • Malware Top 10 for December 2007 27 • Other Events in December 27 More Malware of Interest 29 Conclusion 30 Resources and Further Reading 31 Glossary 32 About ESET 35 About ESET Nod32 Antivirus and ESET Smart Security 35 About Threatsense® 35 Sales Hotline: (852) 2893 8860 www.eset.hk ESET Global Threat Report for 2007 3 Introduction & Overview ESET’s product line has, traditionally, been focused on the detection and removal of viruses and other forms of malicious software, though you’ll notice as you read through this document that we do rather more than that, and that our product range is increasing in versatility. Still, the data resources that we’ve mined so as to bring you this summary are still focused on malware, so we won’t make more than a fleeting reference to other fascinating security-related phenomena and issues that have dominated this year, such as: • The use of Acrobat PDF files and other graphics-friendly objects such as Excel spreadsheets in spam and scams, such as pump and dump fraud • The rise of Microsoft’s Vista and some heated discussion about its security enhancements • The increasing attention paid to Web 2.0 technologies (collaborative technologies and platforms, such as wikis, blogs, moodle and so on), to virtual worlds like Second Life, and to social networks like Facebook, MySpace, Ning, and LinkedIn by security specialists and blackhats alike • The ongoing diversification and increasing sophistication of botnet technology and topology • The continuing shift away from replicative malware (viruses and worms) to other forms of malware (backdoors, keyloggers, banking Trojans), and from hobbyist virus creation to professional crimeware development • The recognition by anti-malware developers, researchers and testers that comparative testing and certification has to move away from testing with known malware to more demanding methodologies designed to test a product’s ability to make use of behavior analysis, heuristics and other forms of proactive and dynamic detection, rather than focusing entirely on malware-specific detection by signature. To produce this summary, we’ve drawn on some of the data resources we use continuously to maintain and improve our product range. In particular, Virus Radar collects data on email-borne malware, while our ThreatSense.Net® technology automatically collects data on all sorts of incoming new and old threats trapped by our heuristics, and immediately forwards information to our Threat Laboratory. These data are primarily intended to give us an edge in the security market by allowing us to improve the detection capabilities of our products, so that we continue to detect not just known malware, but brand new threats, by continuing to improve our sophisticated proactive detection technologies. We hope that you’ll find this peek into the innards of our technology and what it’s picked up over the past 12 months interesting, informative and useful. Sales1-866-343-ESET Hotline: (852) (3738)2893 8860 www.eset.comwww.eset.hk 4 Top Ten Email-Borne Threats “Virus Radar On-line” is a project initiated by ESET and partners for the monitoring and statistical analysis of malware spread via electronic mail. The top ten email-borne threats of 2007, as reported by Virus Radar, are as follows. The figures represent the number of instances recorded as of 10th December 2007, and an explanation of the names used is given below: Name by which Malware is Detected by ESET Number of Detections “A variant of Win32/Stration.XW” 11,608,228 “Probably unknown NewHeur_PE virus” 4,184,672 Win32/Netsky.Q worm 3,355,513 Win32/Nuwar.gen worm 2,965,119 Win32/Fuclip.B trojan 1,740,631 Win32/Stration.XW worm 1,300,049 “A variant of Win32/Stration.WL worm” 760,689 “Probably a variant of Win32/Nuwar worm” 745,021 Win32/Stration.WC worm 668,624 “A variant of Win32/Stration.QQ worm” 585,736 Other malware instances recorded: 5,895,524 Figure 1: Relative Proportions of the Top Ten Email-Borne Threats Note: At the time of data capture, 1,142 individual threats were identified by Virus Radar. More up-to-date and detailed information is available at http://www.virusradar.com/stat_01_current/index_all_c12m_enu.html Sales Hotline: (852) 2893 8860 www.eset.hk ESET Global Threat Report for 2007 5 Table 1 What the Names Mean “A variant of Win32/Stration.XW worm” † Malware closely resembling Win32/Stration.XW has been detected. “Probably unknown NewHeur_PE virus” Heuristic (see glossary) detection of unknown malware. Win32/Netsky.Q †† Threat-specific detection of a common internet worm Win32/Nuwar.gen worm ††† Generic detection of a Nuwar variant Win32/Fuclip.B trojan †††† Threat-specific detection of the Fuclip.B Trojan. Win32/Stration.XW worm † Threat-specific detection of a particular Stration variant. “A variant of Win32/Stration.WL worm” † Malware has been identified generically as closely resembling a Stration variant “Probably a variant of Win32/Nuwar worm” ††† Malware has been identified as