Internet Security Report QUARTER 1, 2017 Contents Contents The Firebox® Feed provides 03 Introduction quantifiable data and trends 04 Executive Summary about hackers’ latest attacks, and 05 Firebox Feed Statistics understanding these trends can 07 Malware Trends help us improve our defenses. 08 Quarter-over-Quarter Malware Comparison 08 Malicious JavaScript Still Menaces 09 A Rise in Linux Malware 11 Evil Cross-platform Java Malware 11 Old Attacks: Malicious Perl Bot 12 A Pair of Generic Windows Trojans 12 Malicious Macros Hide in the Weeds 13 Geographic Malware Distribution 14 Zero Day vs Known Malware 15 Network Attack Trends 15 Top Network Attacks 16 Quarter-over-Quater Attack Comparison A B 16 Web Battleground Shifts to Servers 16 Web Application Attacks Move Up Reset A B 17 StageFright Returns to the Spotlight Reset 18 Geographic Attack Distribution 20 Firebox Feed Statistics: Defense Learnings 20 Malicious JavaScript in Email 20 Web-based Linux Malware 20 Brazilian Banking Malware Campaign 21 Top Security Incidents 22 The CIA Vault 7 Leaks 25 Marble Framework Defense Learnings 26 WatchGuard Threat Lab’s IoT Research Project 27 Responsible Disclosure: Ouvis C2 HD Security Camera 31 IoT Research: Defensive Learnings 32 Conclusion & Defense Highlights Internet Security Report: Q1 2017 • 2 Introduction The report for Q1 2017 Introduction includes: Have you ever wondered what Many trends and discoveries from types of cyber attacks affect small 05 the Firebox Feed to midsize businesses (SMBs) and What types of malware do we catch most often in the wild? Which network services do distributed enterprises (DEs)? Well, attackers commonly target? What are the you’ve come to the right place. most popular attacks in different regions of the world? Which delivery mechanisms do cyber WatchGuard’s Internet Security Report is based on criminals most regularly rely on? You can learn Firebox Feed data coming from more than 26,000 all this and more in our Firebox Feed Statistics unified threat management (UTM) appliances that section. are monitoring and protecting SMBs and distributed enterprises around the world. This data gives us Top Story: CIA Vault 7 leaks Every quarter, you’re flooded with interesting insights into what types of network exploits, malware 11 and relevant information, security stories and infections, and advanced attacks are launched by incidents. Some of them can have industry- cyber criminals every month, and how they change wide effects. This quarter our researchers and update their attacks over time. We share these comment on the CIA Vault 7 leak from Q1 2016 trends and insights with you every quarter in our and share some additional technical analysis Internet Security Report. you didn’t see in the news. Latest Internet of Things (IoT) 22 research The WatchGuard Threat Lab constantly runs security research projects to study the threats and issues affecting businesses today. For the last few quarters, our researchers have been analyzing the security of consumer IoT devices. This quarter we disclose a vulnerability we found in the Ouvic C2 HD Security Camera. Most importantly, defensive learnings 33 While some might consider the threat landscape interesting on anecdotal merit alone, you can put these trends and learnings to good use. We share these trends and findings so that you can cater your defenses to the latest attacks. We share various protective tips throughout this report, and summarize with our top learnings. We’re excited to share our second report based on data analysis from our Firebox Feed, and our additional re- search projects. We believe this quantifiable data gives us a deeper insight into the most prevalent threats our customers face and how cyber criminals craft their latest attacks. Our quarter-over-quarter analysis also shows how attackers evolve their techniques and focuses over time. We hope this report provides useful information, and you make it a regular part of your InfoSec awareness and training. Thanks for joining us this quarter, and read on for our latest threat landscape findings. Internet Security Report: Q1 2017 • 3 Summary Executive Summary Even when malware declines, other attacks rise. Consumers and businesses are under the constant deluge of network attacks, phishing, and malware. Criminals target Brazilian banks, nation-states anonymize their tools, and advanced threats get past legacy defenses. If you want to keep your business online, you need to stay vigilant against these attack trends so you can identify defenses for them. This report provides some details around those and other trends. Here’s a high-level summary of some of the things you’ll learn from this report: • Linux malware is on the rise, making up 36% of the top malware we detected in Q1 (if you count PERL/Shellbot). We believe this increase comes from attackers targeting IoT devices. • Legacy AV missed 38% of malware. In Q4, signature-based AV missed 30% of the threats we caught overall. This quarter, those misses increased 8% despite a general decline in malware detection overall. This means increasingly more malware evades traditional AV solutions. • Threat actors take a break from hacking the holidays. Overall, threat volume decreased 52% in Q1 2017 compared to Q4 2016. We believe the drop in malware detections can be attributed to the absence of seasonal malware campaigns associated with various Q4 holidays, which increased overall malware instances during that period. • Conversely, network attacks are up 37% compared to Q4, likely due to automated tools that always look for new victims. • The web battleground shifted towards web servers. Last quarter, we saw more exploits that were used for drive-by downloads (web client attacks). In Q1, 82% of the top network attacks targeted web servers (or other web-based services). • Our top ten XSS attack primarily targeted Spain. We aren’t sure why this particular cross-site scripting exploit was popular in Spain, but it was. • Attackers still exploit the Android StageFright flaw. A mobile device vulnerability cracked our top ten attack list this quarter, breaking the previously unchallenged web attack theme. • Criminals target Brazilian banks with cross-platform malware. We detected a large amount of email- based Java malware sent to victims in Brazil. We suspect this is part of the well-known Banloader banking malware campaign. Those are just a few of the many trends this report explores. Read on for more in-depth explanations and 7,072,178 In Q1, 2017 malware variants WatchGuard (266 per device)* blocked over 4,151,210 malware variants (156 per device)* * average per participating device Internet Security Report: Q1 2017 • 4 Firebox Feed Statistics Internet Security Report: Q1 2017 • 5 Firebox Feed Statistics Firebox Feed Statistics The threat landscape does not stand still. Cyber criminals constantly change their tools, tactics, and campaigns to exploit the most opportune attack techniques of the time. Savvy attackers pay attention to seasonal events, pop culture, and other technological trends to leverage the latest tricks to hack more victims. To keep up your defenses, you must remain aware of the latest threat trends. Using this report, you can fine-tune your defenses to block the latest threats. WatchGuard’s Firebox Feed provides quantifiable The Firefox Feed currently only captures data data about the latest malware and network attacks from a fraction of our customers, since it relies globally. The feed is a database of anonymized on customers running the latest versions of our threat data gathered from tens of thousands of firmware. However, with information from over active Fireboxes around the globe. It records the 26,000 devices, the Firebox Feed provides a statistically relevant view into today’s threats. latest malware from our Gateway AntiVirus (GAV) and APT Blocker services, and it archives the most This section of the report highlights the malware and prevalent network attacks blocked by our Intrusion network attack trends our Firebox Feed uncovered in Prevention Service (IPS) service. It also records Q1 2017. Here we share our analysis of these trends, location data to learn how different threats affect and provide defense tips that help you avoid the different geographic regions. It doesn’t, however, latest malware and attacks. capture any sensitive data about our customers’ networks or configurations, and allows customers to optout of this feed whenever they like. The information from over 26,000 devices, the Firebox feed provides a statistically relevant view into today’s threats. This section of the report highlights the malware and network attack trends our Firebox Feed uncovered in Q1 2017. Here we share our analysis of these trends, and provide defense tips that help you avoid the latest malware and attacks. Internet Security Report: Q1 2017 • 6 Firebox Feed Statistics Malware Trends Most cyber attacks involve malware. After breaching your network, criminals usually want to establish “persistence,” meaning they want to find a way to retain access to your computer and network. Typically, they install malware to retain this persistence. This section details the malware-specific trends from our Q1 2017 data. Let’s start with the raw Q1 2017 numbers: • The Firebox Feed recorded threat data from Our malware data comes from two 26,584 active Fireboxes; a 7.7% increase in Firebox services: devices reporting in Q4 2016. • The basic Gateway AntiVirus (GAV) service, • Our GAV service blocked 7,072,178 malware which uses signatures and static heuristics to variants; representing an average of 266 malware catch known malware. samples blocked per Firebox. This represents a • APT Blocker, our advanced malware prevention 52% decline in overall malware compared to last service, which uses behavior detection to catch quarter, and a 56% decline in malware blocked new or “zero day” malware. per Firebox. • APT Blocker stopped an additional 2,568,727 malware variants; representing a 34% decline Figure 1: Top Ten Firebox GAV Hits for Q1 2017 from last quarter.