As 2011 draws to a close we wanted to take a look at computer and information security in the twelve months that have passed.
What will probably stick in most people’s minds is the Sony PlayStation Network and Qriocity hack, which resulted in an outage lasting 23 days. In other developments, hacktivist groups like Anonymous and LulzSec took to social media to further their causes, and mobile malware got more attention than ever before.
All in all, there’s no doubt that 2011 was a very busy year for IT security professionals.
Malware
- 76.76% – Trojans accounted for this share of new malware samples.
- 49.97% – The top 10 most prevalent malware specimens accounted for almost half of all infections.
- 26% – This much more malware was created in the first month of 2011 compared to the same month the year before.
- 150,000 – The number of new malware samples per day.
- 73,000 – The average number of new threats created and released every day.
- 62.6% – China had the highest rate of infections of any country around the world.
- 4 million – The number of machines spread over 100 countries that the malware DNSChanger was estimated to have infected.
- 41,000 – The number of computers in the Kelihos botnet, taken down by Microsoft in September.
- 3.8% – The percentage of emails in which malicious files were found in June.
- 44.7% – The share of all malware that was hosted in the U.S.
- 38.03% – The share of .txt, the most common malware file extension, out of all malware in January.
- 87% – This percentage of websites used to spread malicious programs were concentrated in just 10 countries
- 25% – The percentage of malware-infected websites that used video and multimedia as bait.
- 89% – The number of users who would recommend to friends and family using Macs to install antivirus software.
Social networking
- 72% – Percentage of companies that restrict access to social networking for employees.
- 23% – The percentage of phishing out of all attacks in social media.
- 97% – The share of respondents on Facebook and Twitter that said they clicked on links without checking for malware.
Hacks and breaches
- 9,651 – The number of active credit card details stolen when Anonymous hacked Stratfor, which affected 50,000 people.
- 1.3 million – Sega had this many customer accounts exposed in June.
- $2.4 billion – The estimated cost of the Sony PSN hack.
- 77 million – Number of user accounts being compromised in the Sony PSN hack.
- 17 – This many Sony websites may have been hacked during 2011.
- 37,608 – The number of SonyPictures.com passwords released by LulzSec.
- 2/3 – A majority of the passwords from SonyPictures.com were found to have been used on at least one other site as well.
- 1.8 million – The number of video gamers affected after hackers penetrated Square Enix servers.
- 32% – The increase in healthcare breaches.
- $6.5 billion – The estimated cost of healthcare breaches.
- $3,000-$4,000 – The going rate for a botnet-based attack toolkit on the black market.
- 531 – The number of rogue certificates generated when DigiNotar’s certificate authority servers were hacked.
- 210,000 – The number of Citigroup customers (about 1% of the total customer base), which had account information compromised in June.
Mobile
- 40% – The share of mobile malware targeting Android.
- 10,000-14,000 – The estimated number of downloads of 22 SMS malware apps published to Android Market and later pulled by Google
- 85% – The share of smartphone threats during August 2011 that targeted Android.
- 34% – At least this much of Android malware was stealing users’ personal data.
- 472% – The increase in Android mobile malware from July to November.
- 273% – The increase in mobile malware in the first half of 2011.
- 55% – Spyware was the main mobile malware threat.
- 2.5 million – The estimated number of mobile malware strains in 2011.
Spam
- 79.55% – The percentage spam out of all messages in January.
- 20x – The increase of fraudulent spam.
- 50% – The share of spam traffic originating in the top five source countries in October 2011.
- 70% – The level spam dropped to from 90% in 2009.
- 47% – Percentage of attempted submissions to prominent social bookmarking sites that were spam.
- 14.8% – Percentage of spam that originated in India during the third quarter, the highest of any country in the world.
- 8 million – The number of people mistakenly spammed by the New York Times.
- 12.5 million – The number of spam messages needed to sell $100 worth of Viagra.
- 20% – The market share of the most common spambot type.
- 53.6% – The most common spam category was pharmaceuticals.
Phishing
- 146 – This is how many new phishing sites hosted on government domains around the world that Netcraft found in July.
- 43% – The percentage of employees that received a simulated phishing email with fake Facebook or Twitter updates from a reputable and trusted server that clicked on a link in the email.
- 2,500 – McAfee found this many new phishing sites per day in the first quarter of the year.
- 48.77% – Percentage of phishing attacks in January that abused the .com TLD.
Vulnerabilities and exploits of software
- 80% – This percentage of WordPress vulnerabilities involving plugins.
- 95% – This percentage of Drupal and Joomla vulnerabilities involving plugins.
- 2 – For the first time ever, the top 10 rating of vulnerabilities included products from just two companies: Adobe and Oracle.
- 7 – Adobe Flash Player’s share of the top 10 vulnerabilities.
- 99 – The number of Microsoft patches during the year (down from 106 in 2010).
- 30% – The percentage of Microsoft’s security patches during 2011 that were critical (compared to 70% in 2006).
DDoS attacks
- 250,000 – The number of computers taking part in a DDoS attack on an unnamed Asian e-commerce company, producing 45 Gbps of traffic.
- 5% – U.S. and Indonesia each accounted for this percentage of DDoS attacks.
- 88.9% – The percentage of HTTP flood out of all DDoS attacks.
Miscellaneous
- $7.7 billion – The price Intel paid for McAfee (the deal was announced in 2010 but completed in 2011).
- 91% – Share of companies that experienced at least one IT security threat from an external source in the last 12 months.
- 30% – Share of companies that felt they were being specifically targeted by cyber-attacks.
- 64.21% – The top intrusion mechanism detected in the second quarter was generic SQL injection.
- 56 MB – The size of the compressed file released by LulzSec, supposedly containing the source code for the Sony Computer Entertainment Developer Network.
- 82% – Symantec found that security is the top concern for participants in its State of Cloud Survey 2011 [PDF].
Let’s hope for a better 2012
That just about wraps up our summary of the state of security in 2011.
Trying to encompass a complete year in one post like this is certainly not easy. Did we miss any significant security-related numbers for 2011? Tell us in the comments below.
