In their third quarter IT Threat Evolution report, Kaspersky Lab analyst Yury Namestnikov said that those two Apple programs appeared on the top 10 list of most vulnerable programs for the first time, beating out Microsoft products.
The iTunes vulnerabilities were spotted by Kaspersky on the Mac OSX v10.5 and later, Windows 7, Vista, and Windows XP SP2. A Kaspersky Lab press officer said QuickTime exploits were found on Windows 7, Vista and Windows XP SP2 or later. But for Mac OSX users, the vulnerabilities either didn't impact their computers or were addressed through security updates.
All told, Kaspersky Lab said that a total of 30,749,066 vulnerable programs and files were detected on computers using the Kaspersky Security Network (KSN), with an average of 8 different vulnerabilities detected on each affected computer.
The two most frequently exploited vulnerabilities -- where malware first entered a computer platform -- were through Oracle's two Java versions, accounting for 35 percent and 21.70 percent of affected computers respectively. Java vulnerabilities were used in 56 percent of all cyber attacks. According to Oracle, different versions of Java are installed on over 1.1 billion computers. Because updates for Java software are installed on demand rather than automatically, there is a longer shelf-life for vulnerabilities. Java vulnerabilities continue to be a favorite of cyber criminals, Namestnikov said, because Java exploits are easy to use under any Windows. And with some additional work by sophisticated malware code writers, cross-platform exploits can easily be created using botnets like Flashfake.
After Java, Adobe’s Flash, Reader/Acrobat, and Acrobat were the number's three four and five spot.
Apple’s QuickTime and iTunes came in at sixth and seventh place, with vulnerabilities showing up on 13.8 percent and 11.7 percent of computers respectively.
Microsoft did not appear on the Top 10 vulnerabilities list for the first time ever, primarily because the automatic updates mechanism in recent versions of Windows has been well developed.
Users on both systems should check Apple’s Security Update page to ensure iTunes and QuickTime are updated with the latest security walls, a Kaspersky Lab spokesperson in Massachusetts said Friday.
