Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/12/2011
02:18 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft: Cybercrime Falling Into Two Distinct Camps

New Microsoft Security Intelligence Report outlines 'marketing campaign' strategies being employed by one group, and related rise in phishing and rogue antivirus software

There are sophisticated cybercrime groups who target organizations or individuals using social engineering or rare exploits, and then there are those cybercriminals who use more widely available attack techniques aimed at a wider audience of victims. Those two approaches are the two main ways cybercrime has shaken out, according to a new report released today by Microsoft.

And unlike the cybercriminals who wage targeted attacks either for espionage, extortion, or big-ticket theft, the broad-brush attacks are all about pilfering a little money here and there from a lot of victims. These attacks are increasingly being run like marketing campaigns, according to Microsoft's new Security Intelligence Report (SIR), Volume 10, which encompasses July 2010 through December 2010.

"We're seeing a polarization of criminal behavior: There's the highly sophisticated, skilled [criminals] who create exploits and go after high-value targets using zero-day attacks, special intelligence, and customized social engineering," says Jerry Bryant, group manager of response communications for Microsoft's Trustworthy Computing Group. "The other [group] uses more accessible attack methods, using maybe the skilled ones' [malware], and social engineering methods for a larger number of people. We're seeing these attacks run more like marketing campaigns, and especially during significant events that attract media attention, such as the disaster in Japan."

Data gathered by Microsoft from more than 600 million Windows machines worldwide for the report shows how that strategy is playing out: Rogue security software was found and blocked on nearly 19 million Windows machines last year, and the top five families of this malware accounted for 13 million of those instances. FakeSpypro was the most common rogue AV in each quarter of 2010, and FakePAV -- which poses as Microsoft Security Essentials -- was the next most commonly spread fake AV in the second half of the year. "We cleaned it out over 730,000 systems," Bryant says.

And phishing attacks using social networking lures jumped a whopping 1,200 percent, from 8.3 percent of phishing in January to 84.5 percent of phishing in December. Online gaming sites are also in the phishing pool, accounting for 16.7 percent of all phishing in June, according to the report.

And pesky adware is back: Two new adware variants, Win32/ClickPotato and JS/Pornpop, came on the scene last year, sending adware up by 70 percent between the second and fourth quarters. ClickPotato pushes ads based on a user's browsing habits, while PornPop pushes adult content, Microsoft's Bryant says. "They both install without your direct permission," he says. "They try to be persistent and avoid removal, but they're not usually doing anything malicious."

The two adware families topped the list of most common threats in the report, with 11.5 percent of Windows machines harboring ClickPotato, and 7.7 percent harboring PornPop.

"Six of the top 10 malware was adware, spyware, or rogue security software. And these have the potential to lead to worse types of malware: With every one malware, there are one or two others we find as well," Bryant says.

There were some bright spots in the SIRv10 report, Bryant says: Reported vulnerabilities declined by 16.9 percent. "That's a trend we've been seeing since 2006," Bryant says. "Newer products lower infection rates: Windows 7 and 2008 have the lowest infection rates across OSes."

Not everyone agrees that fewer publicly disclosed vulnerabilities is necessarily good news. Nick Selby, managing director of PoliceLedIntelligence.com and a Texas police officer, says touting a decline in publicly disclosed vulnerabilities gives people a false sense of security. "As the malware industrial complex becomes more professional and profit-seeking, it should be no surprise to anyone that the number of public vulnerability disclosures comes down because they are making money from undisclosed vulnerabilities. It's no longer about the glory: It's the money," Selby says.

Selby says that when the bad guys discover a vulnerability, they try to exploit it. "The first call isn't to your vendor. It's to your developers," he says. "Like any for-profit, their intellectual property is a carefully guarded secret."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.