ReversingLabs provides comprehensive information on exploits in the wild and the vulnerabilities that may be present in organizations. Through deep content inspection and a massive private sample collection, ReversingLabs solutions alert companies as well as inform other vendor solutions depth of coverage in regard to the danger potentially lurking in their networks. With an opportunity to dig deeper on specific details SOC/analyst teams can drive remediation via very fast, automated inspection and analysis solutions.

As we learned in last year’s report, attackers leverage more than just the newest vulnerabilities to carry out successful attacks. Looking at newly discovered exploit samples for all known vulnerabilities, not just those discovered in 2015, different patterns emerge. Alarmingly, 2015 is still dominated by CVE-2010-2568224 (patched again in early 2015225), although the overall proportion is a bit lower (29% in 2015 vs. 33% in 2014). In fact, it is disheartening to see that the top 10 vulnerabilities exploited overall (Figure 14) continue to be those that are more than a year old (and 48% are five or more years old).

Surprisingly, the old Shortcut Icon Loading Vulnerability first discovered by VirusBlokAda during the initial analysis of Stuxnet is followed by samples exploiting CVE-2012-6422,226 a vulnerability in Samsung Exynos processors, which allows the attacker to escalate privileges by being able to arbitrarily read and write system memory. The prevalence of CVE-2012-6422 is likely indicative of the increased popularity of Samsung smartphones and the Android operating system.