Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
Summary: Unit 42 analyzed firewall traffic from May 1 to July 21, 2020, and found 56.7% of observed attacks were high severity and 23% critical, with the most exploited vulnerabilities being CVE-2012-2311 and CVE-2012-1823, both command injection flaws in PHP CGI scripts. China had the highest attack activity, followed by Russia and the United States, with Monday the busiest day and 8.82% of traffic falling into the proxy-avoidance-and-anonymizers domain category, including Tor use.
What you should know: The two most-exploited flaws were disclosed in 2012 and were still being exploited eight years later, which means unpatched legacy systems remain a live target rather than a historical one. And with 45.07% of observed traffic tied to malicious domains and attackers routing through Tor and dynamic DNS, source-country attribution is a weak basis for blocking.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2012-1823CVE-2012-2311
- Related
- CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022