Endpoint
4/26/2010
04:33 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Enterprises Hit Hardest By Worms; Consumers By Trojans And Adware

Rogue AV was the common denominator threat to all users, according to findings in the new Microsoft Security Intelligence Report

Enterprises and consumers each suffer from different types of malware threats, but both were hit hard by rogue antivirus attacks last year, according to new data released by Microsoft today.

Version 8 of the new Microsoft Security Intelligence Report (SIR) for the first time separated enterprise user and consumer user malware trend data. The report found that enterprise users contract more worms, while consumers contract Trojans and adware. SIR 8 is based on data gathered from 500 million PCs across the globe between July and December 2009.

"In the enterprise, worms are more of a problem, which is not a surprise in that you have networks with trusted file shares and USB devices, and they are more susceptible to those transmission mechanisms," says Matt Thomlinson, general manager of product security in Microsoft's Trustworthy Computing group. "This is the first time we've had data allowing us to separate [enterprise and consumer machines] and show differences [in malware prevalence.]"

Worms were found in 32 percent of enterprise PCs, followed by miscellaneous Trojans (18 percent), unwanted software (16 percent), Trojan downloaders and droppers (13 percent), password-stealers and monitoring tools (7 percent), backdoor programs (5 percent), viruses (4 percent), exploits (3 percent), adware (3 percent), and spyware (1 percent).

Consumer PCs had more miscellaneous Trojans -- one-fourth of them. Worms and Trojan downloaders and droppers were found in 15 percent of consumer Windows machines, followed by unwanted software (13 percent), adware (12 percent), password-stealers and monitoring tools (9 percent), backdoor programs (4 percent), viruses (3 percent), and exploits and spyware (2 percent).

It's not surprising that consumer PCs were more infected with Trojans and adware because those are typically spread via browsing, Thomlinson says. "And the enterprise has a CIO or CISO managing antivirus...the consumer doesn't get that same sort of protection."

Rogue antiviruses, meanwhile, remains a problem for all types of users, enterprise and consumer, according to the report. Rogue security software was found on 7.8 million Windows machines in the second half of last year -- a 46 percent increase over the first half of 2009. And the third most prevalent threat detected by Microsoft worldwide was a rogue security software family called Win32/FakeXPA.

"We're seeing that the criminals are more professional and organized," Thomlinson says. "[It's] not the guy in his garage doing this in his spare time. This is really about criminals in shirts and ties, not with tattoos."

Criminals are becoming more specialized in different aspects of cybercrime, and then coordinating with other criminals with other specialties, he says. "Threats are being packaged together and sold as commodities and kits," he says. "It struck us as we looked at botnets that this is an early version of cloud computing: There is computing available for whatever use they have in mind, and they are taking advantage of a large number of machines to do that. This is the 'black cloud' of computing."

And continuing a trend that began early last year and was reflected in the SIR 7 report for the first half of 2009, Microsoft found that vulnerability disclosures dropped 8.4 percent from the first half of '09, with around 2,500 new bugs.

Randy Abrams, director of technical education at Eset, says the report's finding that more than 45 percent of all browser exploits were against Adobe Reader was telling: "That's huge...drive-bys weren't targeting Windows anything per se. This shows how vulnerable Adobe has been," Abrams says.

The good news from the SIR 8 report, according to Microsoft, is its data showed newer operating systems and up-to-date applications are the most secure: Windows 7 and Vista Service Pack 2 have the lowest infection rates -- 21.7 XP SP1 machines and 14.5 XP SP2 machines had to be cleaned per 1,000 executions of the Microsoft Malicious Software Removal Tool (MSRT) in the second half of last year. That's in contrast to only 1.4 machines for 64-bit versions of Windows 7 and Windows Vista SP2, and 2.8 for 32-bit Windows 7, and 2.2 for Visa SP2.

"Newer is better," Microsoft's Thomlinson says. "With Internet Explorer, IE 6 is four times more targeted in drive-by attacks."

Thomlinson says SIR 8 provides the first real data to illustrate this. "This is the first time we had Windows 7 data as well," he says.

SIR v8 is available for download here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.