JSOC INSIGHT vol.10 English Edition

"JSOC INSIGHT" is an analysis report on the trend of security incidents, such as unauthorized access and malware infection, in Japan, based on daily analysis results by our JSOC security analysts. Since this report analyzes the trends in attacks, based on the data of incidents which JSOC customers actually encountered, the report will help in understanding world trends as well as actual threats that Japanese users are facing.

JSOC INSIGHT vol.10 contains below topics.

• Relationship between increasing exploit kits and ZeusVM
• DoS vulnerability found in BIND (CVE-2015-5477)

Contents

1. Preface
2. Executive Summary
3. Trends in Severe Incidents at the JSOC
    3.1 Trends in severe incidents
    3.2 Analysis of severe incidents
    3.3 Attack traffic from the Internet that has been detected many times
     3.3.1 Hosts that allow SNMP queries from the Internet
     3.3.2 Code execution attempts against a variety of content management system (CMS) applications
     3.3.3 SQL injection attacks designed to alter Web pages
     3.3.4 Attack traffic that uses a vulnerability scan tool
4. Topics of This Volume
    4.1 Relationship between increasing exploit kits and ZeusVM
     4.1.1 Relationship between increasing detections of exploit kits and ZeusVM
     4.1.2 Behavior and characteristics of ZeusVM traffic
     4.1.3 Countermeasures against infection by ZeusVM and other malware types that target online banking
    4.2 DoS vulnerability found in BIND (CVE-2015-5477)
     4.2.1 Overview of the denial-of-service vulnerability in BIND
     4.2.2 Testing attack traffic that exploits the vulnerability
     4.2.3 Countermeasures against attacks that exploit the vulnerability
5. Conclusion