Turkey Largely Contaminated by Sality and GOZ - CSIS

Softpedia.com reported on 29th August, 2014 quoted a report recently conducted and published by CSIS Security Group in Denmark as saying that Turkey recorded more number of infections owing to Sality and GOZ (Gameover Zeus Trojan) as compared to 28 other member nations of the EU (European Union).

The research revealed that amongst the two botnets, more number of contaminations per 1,000 Internauts was recorded in Turkey having net connection when compared against the standard of all countries of the EU during 1st quarter of the year.

In Sality's case, the amount was 4.8 times more and the amount of tainted machines was 1.2 times more in case of Gameover Zeus.

It is significant to highlight that 47% of population in Turkey is connected to Internet which is much less than Netherlands or Denmark where 96% of population is connected to this service.

Softpedia.com reported on 29th August, 2014 quoting a report of Security Researcher Stefan Frei as saying that 37 times more Sality is there in Turkey and 1.6 times more GOZ (Gameover Zeus) contaminations per 1,000 Internauts as compared to Germany.

The comparison of data of the two nations has been conducted because these two countries almost have same population but they differ on Internet connectivity as Germany having almost double connectivity than Turkey.

Threatpost.com published a statement on 28th August, 2014 quoting Frei as "The most derogatory regarding Turkey's overall security position is that it has more than double the market share of Windows XP computers as compared to Germany. Turkey's less security as compared to similar targets makes it easier pickings."

More machines are vulnerable to advanced and commodity attacks due to Turkey's high percentage of Windows XP computers in use (23.4%) as compared to the average of rest of Europe (16.4%).For example, XP lacks many memory exploit mitigations present in later version of operating system.

CSIS said that it collected and analyzed more than 4,000 botnet configuration files during last 12 months and learned lot about blacklisted domain it uses to avoid antivirus and invasion detection signatures and also webinjects the malware families to hijack broswser sessions and steal credentials.

» SPAMfighter News - 9/9/2014