JSOC INSIGHT vol.12 English Edition

"JSOC INSIGHT" is an analysis report on the trend of security incidents, such as unauthorized access and malware infection, in Japan, based on daily analysis results by our JSOC security analysts. Since this report analyzes the trends in attacks, based on the data of incidents which JSOC customers actually encountered, the report will help in understanding world trends as well as actual threats that Japanese users are facing.

JSOC INSIGHT vol.12 contains below topics.

• Spate of network security device vulnerability disclosures
• Sharp increase in Bedep infection incidents

Contents

Introduction

Executive Summary

1. Section1 Summary of Trends from January to March 2016
2. Section2 FY2015 Trend Summary

Section1 Summary of Trends from January to March 2016

1. Trends in Severe Incidents at the JSOC
    1.1 Trends in severe incidents
    1.2 Analysis of severe incidents
    1.3 Notable vulnerabilities
     1.3.1 SQL injection attack that exploits a Magento vulnerability
     1.3.2 Code execution vulnerability in JBoss Application Server
     1.3.3 Trends in unauthorized login attempts to FTP servers
     1.3.4 Unauthorized PHP code execution attempt against vBulletin
2. Topics of This Volume
    2.1 Spate of network security device vulnerability disclosures
     2.1.1 Overview
     2.1.2 Authentication circumvention vulnerability in Juniper's ScreenOS
     2.1.3 Authentication circumvention vulnerability in Fortinet's FortiOS
     2.1.4 Code execution vulnerability in Palo Alto Networks' PAN-OS
    2.2 Sharp increase in Bedep infection incidents
     2.2.1 Characteristics of the Bedep infection
     2.2.2 Trends in Bedep-infected traffic
     2.2.3 Destination domain names and access URLs used when Bedep infection occurs
     2.2.4 How Bedep infections occur, with countermeasures

Section2 Fiscal Year 2015 Trend Summary

1. FY2015 Summary
2. Severe Incidents Related to Attacks from the Internet
    2.1 Detection trends
    2.2 Device- and system-specific countermeasures against vulnerabilities
3. Severe Intra-network Incidents
    3.1 Detection trends
    3.2 Emdivi and targeted attacks
    3.3 Rise of ransomware infections