Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/26/2010
04:33 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Enterprises Hit Hardest By Worms; Consumers By Trojans And Adware

Rogue AV was the common denominator threat to all users, according to findings in the new Microsoft Security Intelligence Report

Enterprises and consumers each suffer from different types of malware threats, but both were hit hard by rogue antivirus attacks last year, according to new data released by Microsoft today.

Version 8 of the new Microsoft Security Intelligence Report (SIR) for the first time separated enterprise user and consumer user malware trend data. The report found that enterprise users contract more worms, while consumers contract Trojans and adware. SIR 8 is based on data gathered from 500 million PCs across the globe between July and December 2009.

"In the enterprise, worms are more of a problem, which is not a surprise in that you have networks with trusted file shares and USB devices, and they are more susceptible to those transmission mechanisms," says Matt Thomlinson, general manager of product security in Microsoft's Trustworthy Computing group. "This is the first time we've had data allowing us to separate [enterprise and consumer machines] and show differences [in malware prevalence.]"

Worms were found in 32 percent of enterprise PCs, followed by miscellaneous Trojans (18 percent), unwanted software (16 percent), Trojan downloaders and droppers (13 percent), password-stealers and monitoring tools (7 percent), backdoor programs (5 percent), viruses (4 percent), exploits (3 percent), adware (3 percent), and spyware (1 percent).

Consumer PCs had more miscellaneous Trojans -- one-fourth of them. Worms and Trojan downloaders and droppers were found in 15 percent of consumer Windows machines, followed by unwanted software (13 percent), adware (12 percent), password-stealers and monitoring tools (9 percent), backdoor programs (4 percent), viruses (3 percent), and exploits and spyware (2 percent).

It's not surprising that consumer PCs were more infected with Trojans and adware because those are typically spread via browsing, Thomlinson says. "And the enterprise has a CIO or CISO managing antivirus...the consumer doesn't get that same sort of protection."

Rogue antiviruses, meanwhile, remains a problem for all types of users, enterprise and consumer, according to the report. Rogue security software was found on 7.8 million Windows machines in the second half of last year -- a 46 percent increase over the first half of 2009. And the third most prevalent threat detected by Microsoft worldwide was a rogue security software family called Win32/FakeXPA.

"We're seeing that the criminals are more professional and organized," Thomlinson says. "[It's] not the guy in his garage doing this in his spare time. This is really about criminals in shirts and ties, not with tattoos."

Criminals are becoming more specialized in different aspects of cybercrime, and then coordinating with other criminals with other specialties, he says. "Threats are being packaged together and sold as commodities and kits," he says. "It struck us as we looked at botnets that this is an early version of cloud computing: There is computing available for whatever use they have in mind, and they are taking advantage of a large number of machines to do that. This is the 'black cloud' of computing."

And continuing a trend that began early last year and was reflected in the SIR 7 report for the first half of 2009, Microsoft found that vulnerability disclosures dropped 8.4 percent from the first half of '09, with around 2,500 new bugs.

Randy Abrams, director of technical education at Eset, says the report's finding that more than 45 percent of all browser exploits were against Adobe Reader was telling: "That's huge...drive-bys weren't targeting Windows anything per se. This shows how vulnerable Adobe has been," Abrams says.

The good news from the SIR 8 report, according to Microsoft, is its data showed newer operating systems and up-to-date applications are the most secure: Windows 7 and Vista Service Pack 2 have the lowest infection rates -- 21.7 XP SP1 machines and 14.5 XP SP2 machines had to be cleaned per 1,000 executions of the Microsoft Malicious Software Removal Tool (MSRT) in the second half of last year. That's in contrast to only 1.4 machines for 64-bit versions of Windows 7 and Windows Vista SP2, and 2.8 for 32-bit Windows 7, and 2.2 for Visa SP2.

"Newer is better," Microsoft's Thomlinson says. "With Internet Explorer, IE 6 is four times more targeted in drive-by attacks."

Thomlinson says SIR 8 provides the first real data to illustrate this. "This is the first time we had Windows 7 data as well," he says.

SIR v8 is available for download here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1575
PUBLISHED: 2019-07-16
Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and p...
CVE-2019-1576
PUBLISHED: 2019-07-16
Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user?s permissions.
CVE-2018-19629
PUBLISHED: 2019-07-16
A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a TCP connection.
CVE-2019-10100
PUBLISHED: 2019-07-16
Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation.
CVE-2019-10100
PUBLISHED: 2019-07-16
UPX 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a denial of service. The component is: src/p_lx_elf.cpp PackLinuxElf32::PackLinuxElf32help1() Line 262. The attack vector is: the victim must open a specially crafted ELF file.