its annual report "Windows Exploitation in 2016" (PDF), which summarizes the "positives and negatives" presented in the most widely used operating system, Microsoft Windows.
In the 25-page report, ESET analyzes vulnerabilities that have emerged over the past 12 months, providing details on the most vulnerable individual components, such as Internet Explorer and Windows User-Mode Components.
Compared to last year's figures, this year's "Windows Exploitation in 2016" report reveals that the number of vulnerabilities patched increased in all areas except one, Internet Explorer (IE), which saw a sharp decrease in the number of vulnerabilities from 242 to 109, over the past twelve months.
On the other hand, Windows User-Mode Components, a processor mode in which most applications and some drivers for Windows OS run, remained just as popular with cybercriminals.
In the report, ESET places Windows User-Mode Components, with 116 vulnerabilities patched, at the top of the chart for 2016. Among the most prevalent ways cybercriminals abuse User-mode 0-days are remote code execution and elevation of privileges attacks.
Despite appearing for the first time in the report, Microsoft Edge has proven to be resistant to exploitation, and a close second, it has been credited with the first 111 “patched” vulnerabilities. Unlike IE, Edge maintains modern security features, such as AppContainer or 64-bit processes for tabs enabled by default, which make it less vulnerable.
The Windows Exploitation Report 2016 contains detailed statistics on vulnerabilities patched in Microsoft-supported versions of Windows, individual components, web browsers, and the Office suite, and also provides information on updates that have been issued. The report's author also takes a detailed look at mitigation techniques in the latest versions of Windows and the effectiveness of security in key web browsers, which are very attractive targets for cybercriminals.
Interested parties can download the full Windows Exploitation in 2016 report here. Additional security insights can be found on ESET's official blog, WeLiveSecurity.com, as well as more information about ESET's advanced security technologies.
