hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
HP Security Research | Cyber Risk Report 2015Figure 1. Top discovered CVE-2014 exploitsCVE-2014-0322 Microsoft Internet Explorer 36%CVE-2014-0307 Microsoft Internet Explorer25%CVE-2014-0515 Adobe FlashCVE-2014-4114 Microsoft Windows11%10%CVE-2014-1761 Microsoft Office7%CVE-2014-1776 Microsoft Internet ExplorerCVE-2014-0496 Mozilla FirefoxCVE-2014-6332 Microsoft WindowsCVE-2014-0497 Adobe FlashCVE-2014-0502 Adobe FlashOthers3%2%1%1%1%3%0% 5% 10% 15% 20% 25% 30% 35% 40%Top CVE-2014 for malware attacksAs discussed above, of the top 10 CVE-2014 exploits seen, none of them targets Java, one ofthe most commonly exploited targets in previous few years. This may indicate that the <strong>security</strong>push, 62 which caused delay in the release of Java 8, is getting some results, although it maybe too early to tell. It may also be a consequence of browser vendors blocking outdated Javaplugins 63 by default, making the platform a less attractive target for attackers.The breakdown of the top 10 discovered exploits over different applications is as follows. Fourexploits are delivered through Internet Explorer; these four together account for almost twothirdsof all CVE-2014-based exploits discovered this year, Two Windows exploits are deliveredusing Microsoft Office files, three using Adobe Flash, and one through Adobe Reader.In-depth analyses of CVE-2014-0505, 64 CVE-2014-1761, 65 CVE-2014-4114, 66 and CVE-2014-1776 67 have been published on the HP Security Research blog over the course of the year.62http://threatpost.com/does-java-8-delay-mean-oracle-finally-serious-about<strong>security</strong>/99908.63http://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-beginsblocking-out-of-date-activex-controls.aspx.64http://h30499.www3.<strong>hp</strong>.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-0515-Adobe-Flash-Player-Exploit/bap/6482744.65http://h30499.www3.<strong>hp</strong>.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-1761-RTF-Vulnerability/ba-p/6440048.66http://h30499.www3.<strong>hp</strong>.com/t5/HP-Security-Research-Blog/Technical-analysis-of-the-SandWorm-Vulnerability-CVE-2014-4114/ba-p/6649758.67http://h30499.www3.<strong>hp</strong>.com/t5/HP-Security-Research-Blog/The-mechanism-behind-Internet-Explorer-CVE-2014-1776-exploits/ba-p/6476220.19