Criminals will continue to Exploit

Helsinki, Finland – May 28, 2015: F-Secure warns of the ongoing risks associated with exploits, which are attacks that take advantage of software vulnerabilities to compromise systems and provide criminals with an entry point for crimeware. Researchers from the security firm say that exploit kits are a constant threat due to a steady supply of vulnerabilities in popular software, creating a stable framework for criminals to use in the creation of digital threats.

"Pieces of software will always have vulnerabilities, and there will always be criminals creating exploits for those vulnerabilities," says F-Secure Senior Researcher Timo Hirvonen. "It's become a whole business model for these criminals, because the security patches that companies release basically expose the vulnerabilities in software. The criminals reverse engineer the patches to find vulnerabilities, and then they target those vulnerabilities with exploits they develop."

Recent research from F-Secure highlights the significance of exploits in the digital threat landscape. According to F-Secure Labs, exploits accounted for 40% of the top detections from crimeware campaigns during the latter half of 2014. The Angler exploit kit, which is a toolkit that gives criminals a simple set of software tools to help them create malware campaigns, was identified as the top digital threat in North America in F-Secure's most recent threat report, and included in the top 5 threats facing Europe and Oceania.

While previous exploit kits have focused on vulnerabilities in Java and older versions of Microsoft Windows, the past 6 months have seen a surge in exploits kits targeting Adobe's popular Flash plug-in. F-Secure Security Advisor Sean Sullivan recently highlighted how the Angler exploit kit has preyed on Flash vulnerabilities, and characterized the plug-in as a "low hanging fruit" to illustrate the popularity of the software as a target.*

Hirvonen developed an open-source tool called Sulo to help security researchers analyze potentially malicious Flash files, and helped Adobe discover an unpatched Flash vulnerability last January.** According to Hirvonen, one way for people to defend themselves against exploits is to make sure their software stays up to date, thereby eliminating many of the vulnerabilities that expose computers to exploit-based attacks. "Software vendors are quite good about releasing patches for these vulnerabilities, so it's important that people use the patches as soon as they become available. Not keeping software updated is a security risk that many people take without even realizing it, which motivates criminals to continue using these types of attack strategies."

F-Secure Booster's premium offering contains a software update feature that can help people monitor their drivers and applications to ensure they're keeping their software up to date. F-Secure's business products also feature "Software Updater" to help businesses keep their software updated and safe from exploits.