Vulnerabilities / Threats
8/1/2011
01:29 PM
50%
50%

Counterfeit Windows XP Breeding Malware

Security firm finds that 74% of all rootkit infections can be traced to Windows XP machines.

Black Hat
Beware Windows XP, as 74% of rootkit infections can be traced to PCs running that operating system. By comparison, only 17% of rootkit infections were spotted running on Vista, and 12% on Windows 7.

That finding comes from Avast--a free antivirus software developer based in Prague--and is based on a six-month study the company conducted of 630,000 malware samples encountered by its users.

Interestingly, the prevalence of rootkits running on Windows XP, which debuted in 2001, is greater than the operating system's actual market share, which for Avast users was 49%, compared with Windows 7 (38%) and Vista (13%).

Attackers favor rootkits because they can surreptitiously be used to gain admin-level access to a PC, then silently install additional files and steal data. "Because of the way they attack--and stay concealed--deep in the operating system, rootkits are a perfect weapon for stealing private data," said Przemyslaw Gmerek, Avast's lead researcher, in a statement. He plans to detail his rootkit research in full, this week at the Black Hat USA conference, a UBM TechWeb event, in Las Vegas.

Most often, rootkits attack the master boot record (in 62% of attacks), followed by driver infections (27%). In terms of specific rootkits, Avast said that Alureon botnet--aka the TDL3 and TDL4 rootkit family--accounted for nearly three-quarters of all rootkit infections.

What, however, makes Windows XP such a rootkit magnet? "One issue with Windows XP is the high number of pirated versions, especially as users are often unable to properly update them because the software can't be validated by the Microsoft update," said Gmerek. As a result, he said, numerous Windows XP users aren't using the latest version--SP3--but rather earlier versions, such as SP2, which Microsoft ceased supporting--as well as patching--in July 2010. (Microsoft has said that it will cease supporting Windows XP SP3 in April 2014.)

Attackers also favor Windows XP because even SP3 lacks some of the anti-rootkit and other security features that Microsoft has added to more recent operating systems, including user account control, PatchGuard, and driver signing.

Since Windows XP, Microsoft has continued to boost the security of its operating systems and applications, although developer uptake of the enhancements can lag. Earlier this year, notably, Microsoft called on developers to implement more secure lifecycle software practices, as well as to better avail themselves of newer Microsoft-built mitigation technologies, including data execution prevention (to prevent attackers from executing arbitrary code) and address space layout randomization (to make it difficult for malware to locate known files on a PC that may contain vulnerabilities).

Read our report on how to guard your systems from a SQL attack. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Verdumont Monte
50%
50%
Verdumont Monte,
User Rank: Apprentice
10/11/2012 | 9:01:06 PM
re: Counterfeit Windows XP Breeding Malware
Who knew that using pirated software is bad.. [Pun intended]
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2013-4663
Published: 2014-12-27
git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.

CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.