Vulnerabilities / Threats
5/12/2011
07:42 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Cybercrime Falling Into Two Distinct Camps

New Microsoft Security Intelligence Report outlines 'marketing campaign' strategies being employed by one group, and related rise in phishing and rogue antivirus software.

There are sophisticated cybercrime groups who target organizations or individuals using social engineering or rare exploits, and then there are those cybercriminals who use more widely available attack techniques aimed at a wider audience of victims. Those two approaches are the two main ways cybercrime has shaken out, according to a new report released today by Microsoft.

And unlike the cybercriminals who wage targeted attacks either for espionage, extortion, or big-ticket theft, the broad-brush attacks are all about pilfering a little money here and there from a lot of victims. These attacks are increasingly being run like marketing campaigns, according to Microsoft's new Security Intelligence Report (SIR), Volume 10, which encompasses July 2010 through December 2010.

"We're seeing a polarization of criminal behavior: There's the highly sophisticated, skilled [criminals] who create exploits and go after high-value targets using zero-day attacks, special intelligence, and customized social engineering," says Jerry Bryant, group manager of response communications for Microsoft's Trustworthy Computing Group. "The other [group] uses more accessible attack methods, using maybe the skilled ones' [malware], and social engineering methods for a larger number of people. We're seeing these attacks run more like marketing campaigns, and especially during significant events that attract media attention, such as the disaster in Japan."

Data gathered by Microsoft from more than 600 million Windows machines worldwide for the report shows how that strategy is playing out: Rogue security software was found and blocked on nearly 19 million Windows machines last year, and the top five families of this malware accounted for 13 million of those instances. FakeSpypro was the most common rogue AV in each quarter of 2010, and FakePAV -- which poses as Microsoft Security Essentials -- was the next most commonly spread fake AV in the second half of the year. "We cleaned it out over 730,000 systems," Bryant says.

And phishing attacks using social networking lures jumped a whopping 1,200 percent, from 8.3 percent of phishing in January to 84.5 percent of phishing in December. Online gaming sites are also in the phishing pool, accounting for 16.7 percent of all phishing in June, according to the report.

And pesky adware is back: Two new adware variants, Win32/ClickPotato and JS/Pornpop, came on the scene last year, sending adware up by 70 percent between the second and fourth quarters. ClickPotato pushes ads based on a user's browsing habits, while PornPop pushes adult content, Microsoft's Bryant says. "They both install without your direct permission," he says. "They try to be persistent and avoid removal, but they're not usually doing anything malicious."



Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.