The annual report "Windows Exploitation in 2016” (PDF) issued by ESET summarizing the “pros and cons” presented in the most widely used operating system, the Microsoft Windows.
On 25 pages of the report, ESET analyzes the vulnerabilities that occurred during the last 12 months, providing details about the most vulnerable components, such as Internet Explorer and Windows User-Mode Components.
Compared to last year, this year's "Windows Exploitation in 2016" report reveals that the number of vulnerabilities fixed increased in all but one area, Internet Explorer (IE), where there was a sharp decline in the number of vulnerabilities from 242 to 109 in the last twelve months.
On the other hand, Windows User-Mode Components, a mode of the processor in which most applications run and some drivers for Windows OS, remained just as popular with cybercriminals.
In the report, ESET places Windows User-Mode Components, with 116 patched vulnerabilities, at the top of theletterfor 2016. Among the mostdata Ways cybercriminals abuse User-mode 0-days are remote code execution and elevation of privileges attacks.
Although it appears for the first time in the report, Microsoft Edge has been proven to be robust and close to second, and has been attributed the first 111 patched vulnerabilities. Unlike IE, Edge maintains modern security features, such as AppContainer, or 64-bit processes for tabs enabled by default, which make it less vulnerable.
The report “Windows Exploitation Report 2016" contains detailed statistics about the vulnerabilities fixed in Microsoft-supported versions of Windows, components, web browsers, as well as the Office suite, and also provides information about released updates. The report's author also takes a detailed look at the risk mitigation techniques in the latest versions of Windows and the effectiveness of security in basic Web browsers, as they are very attractive targets for cybercriminals.
Stakeholders can download the entire Windows Exploitation in 2016 report here. Additional security information on ESET's official blog, WeLiveSecurity.com, as well as more information on ESET's advanced security technologies.
