Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/26/2010
04:33 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Enterprises Hit Hardest By Worms; Consumers By Trojans And Adware

Rogue AV was the common denominator threat to all users, according to findings in the new Microsoft Security Intelligence Report

Enterprises and consumers each suffer from different types of malware threats, but both were hit hard by rogue antivirus attacks last year, according to new data released by Microsoft today.

Version 8 of the new Microsoft Security Intelligence Report (SIR) for the first time separated enterprise user and consumer user malware trend data. The report found that enterprise users contract more worms, while consumers contract Trojans and adware. SIR 8 is based on data gathered from 500 million PCs across the globe between July and December 2009.

"In the enterprise, worms are more of a problem, which is not a surprise in that you have networks with trusted file shares and USB devices, and they are more susceptible to those transmission mechanisms," says Matt Thomlinson, general manager of product security in Microsoft's Trustworthy Computing group. "This is the first time we've had data allowing us to separate [enterprise and consumer machines] and show differences [in malware prevalence.]"

Worms were found in 32 percent of enterprise PCs, followed by miscellaneous Trojans (18 percent), unwanted software (16 percent), Trojan downloaders and droppers (13 percent), password-stealers and monitoring tools (7 percent), backdoor programs (5 percent), viruses (4 percent), exploits (3 percent), adware (3 percent), and spyware (1 percent).

Consumer PCs had more miscellaneous Trojans -- one-fourth of them. Worms and Trojan downloaders and droppers were found in 15 percent of consumer Windows machines, followed by unwanted software (13 percent), adware (12 percent), password-stealers and monitoring tools (9 percent), backdoor programs (4 percent), viruses (3 percent), and exploits and spyware (2 percent).

It's not surprising that consumer PCs were more infected with Trojans and adware because those are typically spread via browsing, Thomlinson says. "And the enterprise has a CIO or CISO managing antivirus...the consumer doesn't get that same sort of protection."

Rogue antiviruses, meanwhile, remains a problem for all types of users, enterprise and consumer, according to the report. Rogue security software was found on 7.8 million Windows machines in the second half of last year -- a 46 percent increase over the first half of 2009. And the third most prevalent threat detected by Microsoft worldwide was a rogue security software family called Win32/FakeXPA.

"We're seeing that the criminals are more professional and organized," Thomlinson says. "[It's] not the guy in his garage doing this in his spare time. This is really about criminals in shirts and ties, not with tattoos."

Criminals are becoming more specialized in different aspects of cybercrime, and then coordinating with other criminals with other specialties, he says. "Threats are being packaged together and sold as commodities and kits," he says. "It struck us as we looked at botnets that this is an early version of cloud computing: There is computing available for whatever use they have in mind, and they are taking advantage of a large number of machines to do that. This is the 'black cloud' of computing."

And continuing a trend that began early last year and was reflected in the SIR 7 report for the first half of 2009, Microsoft found that vulnerability disclosures dropped 8.4 percent from the first half of '09, with around 2,500 new bugs.

Randy Abrams, director of technical education at Eset, says the report's finding that more than 45 percent of all browser exploits were against Adobe Reader was telling: "That's huge...drive-bys weren't targeting Windows anything per se. This shows how vulnerable Adobe has been," Abrams says.

The good news from the SIR 8 report, according to Microsoft, is its data showed newer operating systems and up-to-date applications are the most secure: Windows 7 and Vista Service Pack 2 have the lowest infection rates -- 21.7 XP SP1 machines and 14.5 XP SP2 machines had to be cleaned per 1,000 executions of the Microsoft Malicious Software Removal Tool (MSRT) in the second half of last year. That's in contrast to only 1.4 machines for 64-bit versions of Windows 7 and Windows Vista SP2, and 2.8 for 32-bit Windows 7, and 2.2 for Visa SP2.

"Newer is better," Microsoft's Thomlinson says. "With Internet Explorer, IE 6 is four times more targeted in drive-by attacks."

Thomlinson says SIR 8 provides the first real data to illustrate this. "This is the first time we had Windows 7 data as well," he says.

SIR v8 is available for download here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "SpearPhish! Everyone out of the office!"
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1919
PUBLISHED: 2019-07-17
A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account w...
CVE-2019-1920
PUBLISHED: 2019-07-17
A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling conditi...
CVE-2019-1923
PUBLISHED: 2019-07-17
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by access...
CVE-2019-1940
PUBLISHED: 2019-07-17
A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid X.509 certificate. The vulnerability is due to insufficient X.509 certifi...
CVE-2019-1941
PUBLISHED: 2019-07-17
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because th...