Microsoft: Enterprises Hit Hardest By Worms; Consumers By Trojans And Adware

Enterprises and consumers each suffer from different types of malware threats, but both were hit hard by rogue antivirus attacks last year, according to new data released by Microsoft today.

Version 8 of the new Microsoft Security Intelligence Report (SIR) for the first time separated enterprise user and consumer user malware trend data. The report found that enterprise users contract more worms, while consumers contract Trojans and adware. SIR 8 is based on data gathered from 500 million PCs across the globe between July and December 2009.

"In the enterprise, worms are more of a problem, which is not a surprise in that you have networks with trusted file shares and USB devices, and they are more susceptible to those transmission mechanisms," says Matt Thomlinson, general manager of product security in Microsoft's Trustworthy Computing group. "This is the first time we've had data allowing us to separate [enterprise and consumer machines] and show differences [in malware prevalence.]"

Worms were found in 32 percent of enterprise PCs, followed by miscellaneous Trojans (18 percent), unwanted software (16 percent), Trojan downloaders and droppers (13 percent), password-stealers and monitoring tools (7 percent), backdoor programs (5 percent), viruses (4 percent), exploits (3 percent), adware (3 percent), and spyware (1 percent).

Consumer PCs had more miscellaneous Trojans -- one-fourth of them. Worms and Trojan downloaders and droppers were found in 15 percent of consumer Windows machines, followed by unwanted software (13 percent), adware (12 percent), password-stealers and monitoring tools (9 percent), backdoor programs (4 percent), viruses (3 percent), and exploits and spyware (2 percent).

It's not surprising that consumer PCs were more infected with Trojans and adware because those are typically spread via browsing, Thomlinson says. "And the enterprise has a CIO or CISO managing antivirus...the consumer doesn't get that same sort of protection."

Rogue antiviruses, meanwhile, remains a problem for all types of users, enterprise and consumer, according to the report. Rogue security software was found on 7.8 million Windows machines in the second half of last year -- a 46 percent increase over the first half of 2009. And the third most prevalent threat detected by Microsoft worldwide was a rogue security software family called Win32/FakeXPA.

"We're seeing that the criminals are more professional and organized," Thomlinson says. "[It's] not the guy in his garage doing this in his spare time. This is really about criminals in shirts and ties, not with tattoos."

Criminals are becoming more specialized in different aspects of cybercrime, and then coordinating with other criminals with other specialties, he says. "Threats are being packaged together and sold as commodities and kits," he says. "It struck us as we looked at botnets that this is an early version of cloud computing: There is computing available for whatever use they have in mind, and they are taking advantage of a large number of machines to do that. This is the 'black cloud' of computing."

And continuing a trend that began early last year and was reflected in the SIR 7 report for the first half of 2009, Microsoft found that vulnerability disclosures dropped 8.4 percent from the first half of '09, with around 2,500 new bugs.

Randy Abrams, director of technical education at Eset, says the report's finding that more than 45 percent of all browser exploits were against Adobe Reader was telling: "That's huge...drive-bys weren't targeting Windows anything per se. This shows how vulnerable Adobe has been," Abrams says.

The good news from the SIR 8 report, according to Microsoft, is its data showed newer operating systems and up-to-date applications are the most secure: Windows 7 and Vista Service Pack 2 have the lowest infection rates -- 21.7 XP SP1 machines and 14.5 XP SP2 machines had to be cleaned per 1,000 executions of the Microsoft Malicious Software Removal Tool (MSRT) in the second half of last year. That's in contrast to only 1.4 machines for 64-bit versions of Windows 7 and Windows Vista SP2, and 2.8 for 32-bit Windows 7, and 2.2 for Visa SP2.

"Newer is better," Microsoft's Thomlinson says. "With Internet Explorer, IE 6 is four times more targeted in drive-by attacks."

Thomlinson says SIR 8 provides the first real data to illustrate this. "This is the first time we had Windows 7 data as well," he says.

SIR v8 is available for download here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.