Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/26/2010
04:33 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Enterprises Hit Hardest By Worms; Consumers By Trojans And Adware

Rogue AV was the common denominator threat to all users, according to findings in the new Microsoft Security Intelligence Report

Enterprises and consumers each suffer from different types of malware threats, but both were hit hard by rogue antivirus attacks last year, according to new data released by Microsoft today.

Version 8 of the new Microsoft Security Intelligence Report (SIR) for the first time separated enterprise user and consumer user malware trend data. The report found that enterprise users contract more worms, while consumers contract Trojans and adware. SIR 8 is based on data gathered from 500 million PCs across the globe between July and December 2009.

"In the enterprise, worms are more of a problem, which is not a surprise in that you have networks with trusted file shares and USB devices, and they are more susceptible to those transmission mechanisms," says Matt Thomlinson, general manager of product security in Microsoft's Trustworthy Computing group. "This is the first time we've had data allowing us to separate [enterprise and consumer machines] and show differences [in malware prevalence.]"

Worms were found in 32 percent of enterprise PCs, followed by miscellaneous Trojans (18 percent), unwanted software (16 percent), Trojan downloaders and droppers (13 percent), password-stealers and monitoring tools (7 percent), backdoor programs (5 percent), viruses (4 percent), exploits (3 percent), adware (3 percent), and spyware (1 percent).

Consumer PCs had more miscellaneous Trojans -- one-fourth of them. Worms and Trojan downloaders and droppers were found in 15 percent of consumer Windows machines, followed by unwanted software (13 percent), adware (12 percent), password-stealers and monitoring tools (9 percent), backdoor programs (4 percent), viruses (3 percent), and exploits and spyware (2 percent).

It's not surprising that consumer PCs were more infected with Trojans and adware because those are typically spread via browsing, Thomlinson says. "And the enterprise has a CIO or CISO managing antivirus...the consumer doesn't get that same sort of protection."

Rogue antiviruses, meanwhile, remains a problem for all types of users, enterprise and consumer, according to the report. Rogue security software was found on 7.8 million Windows machines in the second half of last year -- a 46 percent increase over the first half of 2009. And the third most prevalent threat detected by Microsoft worldwide was a rogue security software family called Win32/FakeXPA.

"We're seeing that the criminals are more professional and organized," Thomlinson says. "[It's] not the guy in his garage doing this in his spare time. This is really about criminals in shirts and ties, not with tattoos."

Criminals are becoming more specialized in different aspects of cybercrime, and then coordinating with other criminals with other specialties, he says. "Threats are being packaged together and sold as commodities and kits," he says. "It struck us as we looked at botnets that this is an early version of cloud computing: There is computing available for whatever use they have in mind, and they are taking advantage of a large number of machines to do that. This is the 'black cloud' of computing."

And continuing a trend that began early last year and was reflected in the SIR 7 report for the first half of 2009, Microsoft found that vulnerability disclosures dropped 8.4 percent from the first half of '09, with around 2,500 new bugs.

Randy Abrams, director of technical education at Eset, says the report's finding that more than 45 percent of all browser exploits were against Adobe Reader was telling: "That's huge...drive-bys weren't targeting Windows anything per se. This shows how vulnerable Adobe has been," Abrams says.

The good news from the SIR 8 report, according to Microsoft, is its data showed newer operating systems and up-to-date applications are the most secure: Windows 7 and Vista Service Pack 2 have the lowest infection rates -- 21.7 XP SP1 machines and 14.5 XP SP2 machines had to be cleaned per 1,000 executions of the Microsoft Malicious Software Removal Tool (MSRT) in the second half of last year. That's in contrast to only 1.4 machines for 64-bit versions of Windows 7 and Windows Vista SP2, and 2.8 for 32-bit Windows 7, and 2.2 for Visa SP2.

"Newer is better," Microsoft's Thomlinson says. "With Internet Explorer, IE 6 is four times more targeted in drive-by attacks."

Thomlinson says SIR 8 provides the first real data to illustrate this. "This is the first time we had Windows 7 data as well," he says.

SIR v8 is available for download here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.