Threat Assessment
The McAfee Threat Assessment evaluates the level of risk posed by the electronic threats we encounter at McAfee Labs. Our team of global threat experts strives to inform you about each threat, its risks and consequences, and recommended actions. We have established a methodology for establishing threat risk to ensure consistency and transparency in our processes. Note that our threat assessments are supplied only for malicious threats, such as viruses, worms, and Trojans, at this time. Potentially unwanted programs (PUPs) are not rated.
We assign the following classifications to threats:
High/Outbreak
High
Medium/On Watch
Medium
Low/Profiled
Low
Not Applicable (N/A)
Learn about McAfee Vulnerability Assessment methodology.
Criteria for Assessing Threats
Risk of a threat to any individual or corporation can be determined by answering the following questions:
- How likely is it that I will be attacked successfully (exposure)?
- What is the impact if I am attacked successfully (impact)?
Note that this is a statement of probability. While it may be true for a hypothetical user and a hypothetical threat, for any individual user or corporation with a real threat, the answer is that you either will or will not be infected. Whether that occurs depends on your particular security posture, countermeasures you have in place, response speed, effectiveness of your countermeasures, and even pure luck. When determining the risk of a threat, McAfee Labs attempts to gauge the average probability for our customers globally. This does not mean that some customers will not be affected by low-risk threats, or that many users will be unscathed by high-risk threats.
Exposure: How likely is a successful attack?
In theory, measuring exposure should be fairly straightforward. If a threat is email-borne, and one in 10 emails contains the threat, then the risk of exposure is 10%. In practice, the situation is seldom this straightforward. Some factors that may alter true exposure levels include:
- The number and popularity of possible targets (Microsoft Windows threats are likely to spread more effectively than Macintosh or UNIX threats)
- The number of propagation or infection vectors the threat is capable of exploiting
- The popularity of those propagation or infection vectors. (For example, significantly more people use email than peer-to-peer file-sharing programs.)
- Whether the threat requires user interaction to mount a successful attack
- If the threat requires user interaction, the effectiveness of the social engineering employed to trick the user into running the threat
- If the threat exploits a vulnerability in a piece of software, the availability of a patch and the length of time that the patch has been available
- The existence and effectiveness of existing countermeasures capable of thwarting an attack. (Do some or most anti-virus vendors detect the threat proactively?)
- The degree to which previous threats exploiting the same vectors are well-known or the media have alerted users to the dangers posed by the social engineering or an unpatched vulnerability
- The degree to which customers have become desensitized to security industry warnings as a result of frequent or exaggerated warnings about other threats
- The number and types of limitation or bugs in the threat's coding
- Whether the threat was actually ever released and how it was released. (Was the threat seeded slowly or mass-spammed? Were the initial seeding attempts thwarted?)
- The speed and effectiveness at which the security community, including security vendors, Internet service providers, and law enforcement agencies, responds to the threat.
The single most reliable measure of exposure is prevalence to date. Prevalence can be thought of as actual, verified customer reports of successful attacks over time. However, measuring this can be complicated as well for these reasons:
- Customers may fail to notify us of infections
- Customers may report blocked threats as if they were infections or vice versa
- Extrapolating infection rates from email volume is flimsy. Threats can vary by many orders of magnitude in terms of number of infected emails per infected machine.
As a result, it is difficult to determine a numeric or absolute standard for different prevalence levels. The following guidelines work with some threats, but McAfee Labs may revise them on a case-by-case basis based on our decade of experience fighting malware. In some cases, higher exposure risks may be assigned:
- High Exposure Potential: The threat has been identified in the field, and more than 20 instances have been reported in less than four hours. Threats exploiting unpatched vulnerabilities in popular operating systems or applications with significant secondary indications of infection may also be placed in this category.
- Significant Exposure Potential: The threat has been identified in the field, and more than 20 instances have been reported during one business day (eight hours). The reported cases can originate in a single country or region or from numerous countries and regions. This includes threats exploiting patched vulnerabilities in popular operating systems or applications, and unpatched vulnerabilities in less common applications or operating systems.
- Moderate Exposure Potential: The threat has been identified in the field, but fewer than 20 instances have been reported over 24 hours. This classification applies to threats exploiting vulnerabilities where a patch has been available for more than a certain number of days.
- Low Exposure Potential: The threat is known to our researchers, but few or no attacks have been reported over a period of several days.
Payload: What kind of damage results from infection?
Like exposure, damage can be difficult to measure in an absolute fashion. Generally, damage that is visible and obvious is considered less severe than damage that is difficult to see or quantify. Examples of more complex damage include:
- Data or potentially confidential files being sent to third-parties
- Loss of reputation or legal liability as a result of data breaches
- Installation of components that allow arbitrary code execution at a future point in time (backdoors and bots)
- Subtle manipulation of data files (see XM/Compat.A)
- Allows attacks on other parties (DDoS clients)
- Causes issues with printers or other network-attached devices (see W32/Bugbear@MM)
- Terminates or otherwise interferes with security products, leading to exposure to unknown future attacks.
Based on these considerations McAfee Labs uses the following guidelines for determining potential damage caused by threats:
- Unforeseeable Damage: The threat redistributes confidential data to third parties, creates additional unbounded security holes, or brings down an entire network.
- Extremely Serious Damage: The threat manipulates data silently or contributes to the harm of others.
- Serious Damage: The threat deletes a number of files, formats hard drives, or deletes the Flash BIOS.
- Medium Damage: The threat deletes individual files or renders the computer temporarily unavailable.
- Minimal Damage: The threat generates bogus text or generates sounds.
Threat Risk Levels
McAfee Labs reports risk levels for threats in order of severity: The risk level assigned to a threat changes as its prevalence changes. Each level is defined below. Recommended actions for customers and actions taken by McAfee Labs with each risk level are listed in a table following the risk level descriptions. The recommended action should be modified to meet your specific needs.
High/Outbreak
These threats are detected by our researchers on most continents within a very short period of time. They are almost always spread via mass mailings or via remote vulnerability exploitation, so they often have a global impact in a matter of hours.
Examples:
- W97M/Melissa
- VBS/Loveletter
- VBS/VBSWG (Anna)
- W32/Nimda
- W32/Mydoom
High
Threats in this category are discovered in the field and have a payload that can cause serious damage. They usually spread rapidly on common platforms with widely used operating systems. If it causes serious or catastrophic damage, it may be classified as high risk even if its prevalence is low.
Examples:
- Win95/CIH
- VBS/Newlove
- W32/SQLSlammer.worm
- W32/Sobig.f
- W32/IRCbot.worm!MS05-039
Examples:
- W97M/Resume
- W32/Badtrans.b
- W32/Fizzer.gen
- W32/Blaster.worm
- W32/Bagle.aa
Examples:
- W32/Sober.c
- W32/Bagle
- W32/Netsky.b
- W32/Sasser.worm
- W32/Zafi.d
Low/Profiled
This rating applies to threats that appear to be low risk but warrant additional monitoring because they have attracted media interest. They may not yet have been discovered in the field and may not have a dangerous payload. We may also classify a threat as a Low/Profiled if it is a variant of a threat with high prevalence and potential to spread.
Examples:
- W32/Bugbros@MM
- W32/Bizex.worm
- W32/Evaman@MM
- W64/Shruggle
Low
This classification is for threats that may not yet have been reported in the field and may not have a dangerous payload. These threats typically target obscure or rarely used applications, though at times, they may run on common platforms.
Examples:
- W32/Cycle.worm.a
- W32/Reatle.gen
- W32/Vulgar
Not Applicable (N/A)
The Not Applicable (N/A) risk assessment is used on descriptions for threats or apparent threats that do not warrant an assessment. For example, email hoax descriptions have a risk assessment of N/A as they are not Trojans or infectious like viruses. Trojan and virus family descriptions and heuristic detection descriptions have a risk assessment of N/A because they are general descriptions and do not describe specific threats.
Updated Threat Assessments
The risk level for a threat can move from lower to higher over a period of time. For example, a virus may start out with an assessment of Low, but is later elevated to a Medium or Medium/On Watch level as its prevalence increases. In most instances where a threat is classified as Medium/On Watch, we frequently raise the threat assessment to High. The level is lowered when the prevalence of the threat decreases. When a threat is no longer classified as a High risk, it often stays in the Medium risk category for a period of time.
Examples of threats that have had their risk assessments raised:
- IRC/Stages
- W32/SirCam
- W32/APost
| Threat Risk Level | Recommended Customer Actions | McAfee Labs Actions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Update All Systems (.DATs or EXTRADAT) | Update Critical Systems | Assess Risk | Deploy Patch | Update HIPS or NIPS Signatures | Post Description | ExtraDAT Created | Emergency .DAT Release | Press Release | Stinger | Virus Alert | |
| High/Outbreak | ASAP | ASAP | Recommended | ASAP | Where applicable | Yes | If necessary | Yes | Yes | Yes | Alert |
| High | ASAP | ASAP | Recommended | ASAP | Where applicable | Yes | If necessary | Yes | Yes | Yes | Alert |
| Medium/On watch | Recom-mended | ASAP | Recommended | Recommended | Where applicable | Yes | If necessary | Yes | Yes | Yes | Advisory |
| Medium | Recom-mended | Recom-mended | Recommended | Recommended | Where applicable | Yes | If necessary | Yes | Yes | Yes | Advisory |
| Low/Profiled | Next regular update | Next regular update | Yes | If necessary | Next Regular Update | Notice | |||||
| Low | As required | On demand | Next regular update | ||||||||
| N/A | As required | On demand | Next regular update | ||||||||
Notes
ASAP: Deploy patches (if necessary to prevent the exploitation of a vulnerability), EXTRA DATs, or full .DATs as soon as available.
Recommended: McAfee Labs recommends that you perform these additional steps as soon as possible.
Where Applicable: McAfee Intrusion Prevention System and Network Security Platform signatures will be released on Medium and above threats when those technologies are capable of protection.
If Necessary: EXTRA DAT files will only be created if the latest full .DAT release does not contain detection for the threat.
Next Regular Update: Low/Profiled and below threats will be included in the next regular .DAT release unless they increase in risk.
