فا

‫ Microsoft Security Intelligence Report (1st section)

Number: IRCRE201507198
Date: 2015-07-21
 
Volume 18 of the Microsoft Security Intelligence Report (SIRv18) provides in-depth perspectives on software vulnerabilities, software vulnerability exploits, malicious and potentially unwanted software, and security breaches. Microsoft developed these perspectives based on detailed trend analysis over the past several years, with a focus on third and fourth quarters of 2014.
Vulnerabilities
Vulnerability Severity
The following figure shows Industry-wide vulnerability disclosures by severity, 1H12–2H14.
 
Medium-severity vulnerabilities—those with CVSS scores from 4 to 7.9—accounted for almost the entire increase in disclosures seen in 2H14, increasing from 59.4 percent of all vulnerabilities in the first half of the year to 72.5 percent in the second. This increase is the result of a research project that uncovered SSL vulnerabilities in a large number of Android apps in the Google Play Store.
 
Vulnerability Complexity
Some vulnerabilities are easier to exploit than others, and vulnerability complexity is an important factor to consider in determining the magnitude of the threat that a vulnerability poses. A high-severity vulnerability that can only be exploited under very specific and rare circumstances might require less immediate attention than a lower-severity vulnerability that can be exploited more easily.
The following figure shows Industry-wide vulnerability disclosures by access complexity, 1H12–2H14.
 
Medium-complexity vulnerability disclosures doubledfrom 1H14 to 2H14, increasing from 48.0 percent of alldisclosures in the first half of the year to 61.5 percent inthe second. The increase is the result of a researchproject that uncovered SSL vulnerabilities in a largenumber of Android apps in the Google Play Store.
Disclosures of Low-complexity vulnerabilities—those thatare the easiest to exploit—also increased significantly in2H14. Low-complexity vulnerability disclosures increased 20.3 percent from1H14 to 2H14, although their share of all vulnerabilities declined from 48.0percent to 36.9 percent.
Disclosures of High-complexity vulnerabilities decreased to 1.6 percent of alldisclosures in 2H14, down from 4.0 percent in 1H14.
 
Operating System, Browser, and Application Vulnerabilities
The following figure shows Industry-wide operating system, browser, and application vulnerabilities, 1H12–2H14.
 
Disclosures of vulnerabilities in applications other than web browsers and operating system applications increased 98.3 percent in 2H14 and accounted for 76.5 percent of total disclosures for the period. The increase is the result of a research project that uncovered SSL vulnerabilities in a large number of Android apps in the Google Play Store. (See page 14 for more information about this project.)
Core operating system vulnerability disclosures increased 23.6 percent in 2H14, although their share of all disclosures decreased from 11.6 percent in 1H14 to 9.1 percent in 2H14.
Operating system application vulnerability disclosures decreased 22.8 percent in 2H14, and accounted for 8.3 percent of total disclosures for the period.
Browser vulnerability disclosures decreased by 12.0 percent in 2H14, and accounted for 6.1 percent of total disclosures for the period.
 
Vulnerability Disclosures
The following figure charts vulnerability disclosures for Microsoft and non-Microsoft products, 1H12–2H14.
 
Microsoft vulnerability disclosures increased from 180 disclosures in 1H14 to 210 in 2H14, an increase of 16.7 percent.
At the same time, disclosures affecting non-Microsoft software increased 93.8 percent. This increase is the result of a research project that uncovered SSL vulnerabilities in a large number of Android apps in the Google Play Store.
 
Exploits
The following figure shows the prevalence of different types of exploits detected by Microsoft antimalware products in each quarter in 2014.
 
Encounters with Java exploits decreased each quarter, becoming the third-most commonly encountered type of exploit by the fourth quarter, while remaining the second-most commonly encountered type of exploit in 2H14.
Encounters with exploits that target operating systems increased slightly to become the second-most commonly encountered type of exploits in 4Q14.
Encounters with document, Adobe Flash Player, and browser exploits remained mostly stable during the second half of the year, and each accounted for a small percentage of total exploits.
 
Reference:
 
 
 
 
 
 
 
 

نظرات

بدون نظر
شما برای نظر دادن باید وارد شوید

نوشته

 
تاریخ ایجاد: 4 مرداد 1394

دسته‌ها

امتیاز

امتیاز شما
تعداد امتیازها:0