Vulnerabilities / Threats
5/12/2011
07:42 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Cybercrime Falling Into Two Distinct Camps

New Microsoft Security Intelligence Report outlines 'marketing campaign' strategies being employed by one group, and related rise in phishing and rogue antivirus software.

There are sophisticated cybercrime groups who target organizations or individuals using social engineering or rare exploits, and then there are those cybercriminals who use more widely available attack techniques aimed at a wider audience of victims. Those two approaches are the two main ways cybercrime has shaken out, according to a new report released today by Microsoft.

And unlike the cybercriminals who wage targeted attacks either for espionage, extortion, or big-ticket theft, the broad-brush attacks are all about pilfering a little money here and there from a lot of victims. These attacks are increasingly being run like marketing campaigns, according to Microsoft's new Security Intelligence Report (SIR), Volume 10, which encompasses July 2010 through December 2010.

"We're seeing a polarization of criminal behavior: There's the highly sophisticated, skilled [criminals] who create exploits and go after high-value targets using zero-day attacks, special intelligence, and customized social engineering," says Jerry Bryant, group manager of response communications for Microsoft's Trustworthy Computing Group. "The other [group] uses more accessible attack methods, using maybe the skilled ones' [malware], and social engineering methods for a larger number of people. We're seeing these attacks run more like marketing campaigns, and especially during significant events that attract media attention, such as the disaster in Japan."

Data gathered by Microsoft from more than 600 million Windows machines worldwide for the report shows how that strategy is playing out: Rogue security software was found and blocked on nearly 19 million Windows machines last year, and the top five families of this malware accounted for 13 million of those instances. FakeSpypro was the most common rogue AV in each quarter of 2010, and FakePAV -- which poses as Microsoft Security Essentials -- was the next most commonly spread fake AV in the second half of the year. "We cleaned it out over 730,000 systems," Bryant says.

And phishing attacks using social networking lures jumped a whopping 1,200 percent, from 8.3 percent of phishing in January to 84.5 percent of phishing in December. Online gaming sites are also in the phishing pool, accounting for 16.7 percent of all phishing in June, according to the report.

And pesky adware is back: Two new adware variants, Win32/ClickPotato and JS/Pornpop, came on the scene last year, sending adware up by 70 percent between the second and fourth quarters. ClickPotato pushes ads based on a user's browsing habits, while PornPop pushes adult content, Microsoft's Bryant says. "They both install without your direct permission," he says. "They try to be persistent and avoid removal, but they're not usually doing anything malicious."



Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.