CoreTrace WhiteSpace

The Application Whitelisting and Security Weblog

How effective is signature-based detection when the malware lasts only 24 hours?

Record-breaking years can sometimes be a good thing, but not when it comes to malware.

According to PandaLabs, 2010 set a record for new online threats, with cybercriminals creating one-third of all malware in existence last year alone. The report found that throughout 2010 the average number of new threats created every day rose from 55,000 to 63,000.

With financial gain being the prime motivator behind the creation of new malware, the study also found that banking Trojans were the most prevalent type of attacks in 2010 at 56%, along with viruses (22%) and worms (10%). Despite all these findings, the one that struck me the most was that 52% of new malware created last year exists for only 24 hours. Then it’s gone. ( Read More… )

Most recent comment:   Tweets that mention How effective is signature-based detection when the malware lasts only 24 hours? -- Topsy.com

[...] This post was mentioned on Twitter by JTKeating. JTKeating said: How effective is signature-based detection when the malware lasts ...

Just days into the new year, malware attacks are starting out where 2010 left off

It’s truly amazing. Less than a week into the new year and things seem to be starting out where the last one left off. Let’s start with how 2010 ended.

Fake White House holiday greeting:
2010 ended with a fake holiday greeting e-card that appeared to come from the White House. It was sent to an unknown number of government employees and contractors, and according to the article, “Malware in fake White House e-card steals data,” contained Zeus malware designed to gain access to computer systems and steal passwords and other sensitive information. Once recipients clicked on the bogus link, hackers were able to gain access to the victim’s computer files and other data. This type of attack was reminiscent of an increasingly number of malware attacks that targeted government agencies throughout 2010.

And here’s what we’ve already seen in the first few days of 2011. ( Read More… )

Please use the comment form and leave your thoughts!

Top Endpoint Security Stories for December 2010 — In a year that forever changed the threat landscape, experts predict more of the same in 2011

December is typically the time when industry experts reflect on the past year and provide their take on what we might expect in the year to come. While the IT security industry saw its share of game-changing incidents in 2010, unfortunately, many agree the same security trends we’ve seen over the past year will continue into 2011. December also saw security professionals looking to adopt new solutions to stop more targeted malware exploits and meet their regulatory compliance goals. Here are some of the top endpoint security stories for December 2010. ( Read More… )

Please use the comment form and leave your thoughts!

My Top Five Blogs of 2010: Stuxnet, McIntel, Whitelisting & More…

Looking back, 2010 was a breakout year for application whitelisting. Once considered an alternative anti-malware solution, a shift has occurred towards a modern, antivirus approach that has application whitelisting as the primary mechanism for preventing the execution of malicious applications, with traditional antivirus solutions playing a more reactive, cleanup role.

Unfortunately, the year also brought a number of security challenges that have permanently changed the threat landscape. The year was highlighted by several new, high-profiled targeted attacks that included the game-changing Stuxnet worm. But through it all was the fact that application whitelisting stopped portions of all these targeted attacks, no matter how new or sophisticated they were. Below, I’ve compiled a list of CoreTrace’s Top 5 blogs for 2010: ( Read More… )

Please use the comment form and leave your thoughts!

CoreTrace 2011 security predictions: More blended malware threats across new platforms

As technology evolves, so do cyber attacks and the security tools we use to protect our systems. With 2011 quickly approaching, I want to share my predictions for next year’s top security challenges. The five themes I’ve included are based on emerging security trends we’ve seen in 2010. I believe the following areas could have a significant impact on the security market in 2011 (for the full list, please read the article here):

  1. Blended threats will become the norm; Stuxnet clones will be rampant, but the real threats will be far more dangerous and sophisticated: My concern is that Stuxnet was far too public and easily discovered. While Stuxnet clones will have a profound impact in the security industry, these threats may be the tip of the iceberg for real threats that are far more powerful and dangerous. ( Read More… )

Most recent comment:   The Stuxnet blueprint — not the worm itself — may be the greatest danger

[...] rule applies to malware creation. In fact, I blogged on this very topic a few weeks ago in my ...