JSOC INSIGHT vol.9 English Edition

"JSOC INSIGHT" is an analysis report on the trend of security incidents, such as unauthorized access and malware infection, in Japan, based on daily analysis results by our JSOC security analysts. Since this report analyzes the trends in attacks, based on the data of incidents which JSOC customers actually encountered, the report will help in understanding world trends as well as actual threats that Japanese users are facing.

JSOC INSIGHT vol.9 contains below topics.

• Malware infection due to targeted attacks
• Attack traffic that exploits a vulnerability in HTTP.sys file processing
• Denial-of-service vulnerability in PHP

Contents

1. Preface
2. Executive Summary
3. Trends in Severe Incidents at the JSOC
    3.1 Trends in severe incidents
    3.2 Analysis of severe incidents
    3.3 Attack traffic from the Internet that has been detected many times
4. Topics of This Volume
    4.1 Malware infection as a targeted attack
     4.1.1 Malware infection as a targeted attack
     4.1.2 Countermeasures against targeted attacks such as Emdivi
    4.2 Attack traffic that exploits a vulnerability in HTTP.sys file processing
     4.2.1 HTTP.sys vulnerability
     4.2.2 JSOC-detected attacks that target the HTTP.sys vulnerability
     4.2.3 Countermeasures against the HTTP.sys vulnerability
    4.3 Denial-of-service vulnerability in PHP
     4.3.1 Overview of the denial-of-service vulnerability in PHP
     4.3.2 Testing attack traffic that exploited the vulnerability
     4.3.3 Countermeasures against attacks that exploit the vulnerability
5. Conclusion