50 Figure 1. HKCERT Incident Reports in 2008
Analysis of Composition of security alerts Further analysis of the partitioning of security incident indicates that the number of
phishing cases that peaked in 2007 has dropped significantly. On the other hand other security incidents active hacking, code injection, defacement, etc. rose
sharply See Table.1. . Among the 611 reported security incidents, code injection 31 and web defacement 19 accounted for half of them.
2.2. Alert statistics
During the period from January to December of 2008, HKCERT published 232 security alerts and no virus alert was published. The low figure in virus alert
attributed to the disappearance of massive worm attack due to a change of strategies of attackers to stay stealthy.
2.3. Special Advisories and Press Briefings
HKCERT issued two special security advisories, one on code injection and another on DNS vulnerability.
In July, Dan Kaminsky announced a critical DNS vulnerability that affects the Internet infrastructure as a whole. HKCERT released a detailed advisory and
2003 2004
2005 2006 2007 2008
Other security incident repor
461 783
206 416
416 611
66
Phishing Incident reports
73 211
434 745
232
25
Spamming incident reports
80 82
47 32
29
3
Spyware incident reports
876 230
78 50
5
All security incident reports 461
936 1375
1127 1271
922
100
Table 1. Distribution of HKCERT security incident reports in 2008
51 issued targeted alert to local ISPs and Internet data centers. HKCERT
monitored the patch progress of major ISPs to ensure they fix the security hole as soon as possible.
After receiving 79 incidents of malware hosting in local website from April to July 2008, HKCERT issued a security advisory and called a press briefing in
August, alerting the public that hackers are targeting web server using the SQL Injection exploit. We advised web server owners to evaluate the security
of their web servers and the web applications running on them. HKCERT alerted the threat of Botnet in a joint press briefing in November 2008
with the Government and Police.
2.4. Miscellaneous
KCERT continued to work closely with the government and law enforcement agency, and held meetings to exchange information and to organize joint
events regularly; We participated in the governments Information Infrastructure Liaison Group
and Information Security Task Force We worked closely with police in pinning down phishing web sites and
command and control servers;
3. Events organized co-organized 3.1. Seminars, Conference and Meetings
