Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:09 PM
Connect Directly

Microsoft Calls For Industry Collaboration To Kill Off Malware Families

Working in isolation disrupts -- but doesn't wipe out -- malware

Malware families rarely die off altogether, but now Microsoft says it's time to change the game to ensure that they do.

Dennis Batchelder, Microsoft's partner director of Windows Protection Services, last week publicly called for security companies, CERTs, ISPs, anti-fraud organizations, and law enforcement to begin working together in a coordinated fashion to eradicate malware families. While anti-malware vendors today share samples and some file metadata and work with law enforcement on botnet sinkholes, for example, these efforts have done little to kill off the top malware threats, he says.

Infamous malware families remain alive and well: Sality, Sirefef, Virut, Zbot, Wimad, and even Conficker each were detected targeting Windows machines tens of millions of times between the period of Sept. 1, 2013, and Jan. 25, 2014, according to data from Microsoft gathered via its real-time detection scans.

"Today, as an industry, we are very effective at disrupting malware families, but those disruptions rarely eradicate them. Instead, the malware families linger on, rearing up again and again to wreak havoc on our customers," Batchelder says.

He says Microsoft decided to call for an industrywide coordinated malware eradication approach after meeting with various Community Emergency Response Teams (CERTs). "What we learned was that as an industry, we need to take advantage of the reach and tools available to stop malware," Batchelder told Dark Reading in an email interview. "If the anti-malware ecosystem can go beyond sharing information and actually coordinate eradication efforts, the anti-malware ecosystem would have a chance to eradicate malware families instead of simply disrupting them."

He points to the recent takedown of the Sirefef/ZeroAccess botnet as an example of the type of coordinated effort needed to kill off malware families. Microsoft worked with the FBI, Europol's European Cybercrime Center, several ISPs, and A10 Networks in the botnet disruption operation.

Richard Domingues Boscovich, assistant general counsel for Microsoft's Digital Crimes Unit, says seizing the offending 18 IPs involved in ZeroAccess was effective. "The heat was so much on that botnet that they just gave up," Boscovich says of the ZeroAccess botnet operators.

Sirefef malware is still holding on, but Batchelder says it's on its way to extinction thanks to the team effort to dismantle it.

"Malware families need to be identified, blocked, sinkholed, starved, seized, and prosecuted. The goal of coordinated malware eradication is to bring industry partners who have specific strengths in these areas together to accomplish this," Batchelder says.

Security vendors could share their detection methods as well as information on the behavior of the malware, and financial institutions, online search, and advertising businesses would then have better ways to identify fraudulent behavior and stop it, he says. CERTs and ISPs would have lists of offending sites and command-and-control servers to block and take down, while law enforcement would then have correlated evidence to use to prosecute the humans behind the malware.

[New report unearths what cybercriminals are charging for stolen identities and hacking services, such as DDoS and doxing. See Glut In Stolen Identities Forces Price Cut In Cyberunderground.]

The typical lone wolf strategy employed today by many vendor security research teams, CERTs, and law enforcement investigations just isn't killing off malware altogether.

"It is counterproductive when you think about it. The antimalware ecosystem encompasses many strong groups: security vendors, service providers, CERTs, anti-fraud departments, and law enforcement," Batchelder said in a blog post. "Each group uses their own strengths and methods to protect their customers and constituents. Each group is able to claim victory from their efforts, but the malware families retain a significant advantage. No matter how big, the reach of each antimalware ecosystem player only extends so far. As a result, our adversaries only need to shift just a bit beyond that reach to get back in business."

Not everyone thinks Microsoft is necessarily the right player to take the lead on this, mainly because malware has moved beyond just Windows. "I'm definitely excited about initiatives like that," says Barrett Lyon, founder and CTO of Defense.net. "But I'm not sure Microsoft is the relevant person in this conversation anymore. Their machines are compromised, but Linux is also ... and there are the Internet of Things" devices that face threats as well, he says.

"There needs to be a way to notify [that a machine] is doing bad things, versus shutting the host off from doing a bad thing," Lyon says.

Joe Stewart, director of malware research for Dell SecureWorks, applauds the move by Microsoft. Collaborating with researchers outside his firm has been something Stewart has done and his team had advocated for some time.

"It's what we've been doing all along," he says. "It makes sense to join a community to know who else is working on" a particular research issue, he says. "If you don't reach out and you're not sharing, you're not going to know" who else is working on it and what they've found, he says.

He says it's not difficult to balance the value add of your own research to your clients and the industry with sharing what you've learned with other researchers.

Whether Microsoft will be able to rally the troops remains to be seen. "The model for this type of coordination needs to be determined collectively. CERTs, security vendors, enterprises, and law enforcement can all play an important part in this effort," Batchelder says. "Certainly, the industry will have campaigns against specific malware families, and members will commit to do their part; however, the industry needs to coordinate their efforts, which will require a lot of information sharing and a method to quickly make decisions to take action. In order to scale, we will need to have a model where any member can propose, run, or coordinate a campaign."

The biggest challenge, he says, will be keeping all parties in sync. Microsoft hopes to generate discussion on coordinated malware eradication at upcoming security events, such as the RSA Conference in San Francisco in late February. The software giant has set up an email account for these events at [email protected]

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-12
Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.
PUBLISHED: 2019-12-12
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP ...
PUBLISHED: 2019-12-12
An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.
PUBLISHED: 2019-12-12
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrat...
PUBLISHED: 2019-12-12
The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.