BuzzSec Blog - On The Recorded Future: Top 2019 Exploited Vulnerabilities List

I wanted to get this info out there because I think it is pretty interesting stuff and Recorded Future has a great reputation for their scientific approach. This document can be downloaded after filling out some information here: https://www.recordedfuture.com/top-vulnerabilities-2019/

Without further ado, here are key take-away from the Recorded Future Report -Buzz

Key Observations 

• For a third straight year, Microsoft was the technology most affected by vulnerabilities, with eight of the top 10 vulnerabilities identified targeting its products, the same number as in our 2018 report. 
• For the first year, six of the vulnerabilities, all impacting Microsoft, were repeats from the prior year. CVE-2018-8174 dropped one spot from the top exploited vulnerability in 2018 to the second in 2019; CVE-2017-11882 stayed in the third spot, while CVE-2012-0158 dropped from ninth to tenth. 
• Only one vulnerability from the 2019 calendar year was ranked in the top 10 that impacted Internet Explorer 10 and 11: CVE-2019-0752. This vulnerability was included in a new exploit kit called Capesand. 
• The number of new exploit kits continued to decrease, dropping from five to four in 2019. Capesand was one new exploit kit that targeted vulnerabilities on this list. An underground forum user claimed to stop development on both Capesand and DarkRat in December 2019. 
• In 2019, 23 new remote access trojans (RATs) were released compared to 37 in 2018. Only one of these new RATs — BalkanRAT — was associated with a top vulnerability that impacted Microsoft WinRAR ACE: CVE-2018-20250.

Verdict released the same list here: https://www.verdict.co.uk/top-software-vulnerabilities-2019/

In 2019, Recorded Future observed strong overlap between the top vulnerabilities observed this year and those in 2018, with six of the vulnerabilities repeated from the prior year.

 

One notable observation from the table above is that CVE-2017- 0199 was ranked as one of the top exploits over the past three calendar years — this is the second occurrence with this annual report, as CVE-2016-0189 was the first vulnerability to make the top 10 vulnerability list three years in a row in 2018’s report. In 2018, CVE-2017-0199 ranked fifth due to its inclusion in the ThreadKit exploit kit and its association with eight different types of malware. CVE-2017-0199 stayed in the top 10 in 2019 as it is still an often-exploited Microsoft vulnerability and still advertised on underground forums for sale with the Silent Doc exploit.

This report continues the trend of analyzing co-occurrences of vulnerabilities with exploit kits and RATs. Recorded Future used a list of 184 exploit kits, using Recorded Future’s exploit kit malware category, as one of the parameters to determine the top referenced and exploited vulnerabilities of 2019. Similarly, the ranking of the top exploited vulnerabilities was based on the co-occurrence with 551 RATs, also from Recorded Future’s RAT malware category.