Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

07:32 PM
Connect Directly

Microsoft Maps Out Malware Haves And Have-Nots

Some countries suffer disproportionately from malware infections and cybercrime, and Windows XP could exacerbate the problem

Malware infections declined an average of 23.3 percent overall in 2011 to 2012 among more than 100 countries, but the story was very different for developing nations with fast-growing Internet connectivity.

A new study by Microsoft shows how some nations suffer more malware infections at the time when they begin building out their Internet and technology infrastructures. The newly published "Cybersecurity Risk Paradox" report draws from malware infection rates gathered from Microsoft's Malicious Software Removal Tool (MSRT) and findings in its semi-annual Security Intelligence Report to analyze how developing nations new to the Net are faring securitywise.

"What was interesting to me is that we found this risk paradox: something we thought was there, and then to come back and show that mathematically," says Paul Nicholas, senior director of Microsoft’s Global Security Strategy & Diplomacy group, and a co-author of the report. "The period of time when countries come online, their cybersecurity risk or exposure to malware actually goes up. We wanted to see what causes this paradox and how to get out of it."

Nations with the worst conditions politically and socioeconomically suffer five times more malware infections than other nations. But the good news is that nations can experience less cybercrime and malware with improved political and social stability, according to the Microsoft report. Take Brazil, which saw a 42 percent drop in malware in one year during 2011 to 2012, after PC ownership and broadband had exploded in that nation. "They are also continuing to grow in institutional stability," Nicholas says.

Trend Micro also has studied Brazil and its malware and cybercrime problems. "Brazil is the fastest-growing country in people connecting to the Internet, and it also has the biggest malware problem as a country" in the Latin American region, says Christopher Budd, global threat communications manager at Trend Micro. Conficker is rampant there on computers, says Budd, formerly with Microsoft's security response team.

Other factors making Brazil a target, he says, are a lack of user education as new users unfamiliar with the Internet have rapidly come online there. Latin America is quietly becoming a new hotbed for cybercrime, and the cybercriminals there are learning their craft from their counterparts in other regions. Cyberattack incidents increased anywhere from 8 to 40 percent last year in Latin America and the Caribbean, depending on the country -- and that's only among nations that reported or knew about the threats hitting them, according to a report published last year by Trend Micro in collaboration with the Organization of American States (OAS).

A lack of cybercrime laws, economic challenges, and unpatched and unprotected citizen machines make the region ripe for cybercrime -- and the data only represents a fraction of the cybercrime incidents there since few incidents are even reported or detected, Trend's report found.

[Cybercriminals in the region have built their own tools and learned from their predecessors in other regions, says Trend Micro report in cooperation with Organization of American States (OAS). See Threat Nuevo: Latin America, Caribbean Cybercrime On The Rise.]

If those factors weren't enough to make developing nations major targets for malware and cybercrime, add to the mix the end of Microsoft's support for Windows XP this April. "Developing countries tend to be much slower to upgrade," Trend Micro's Budd says. "Microsoft has said no more security updates for XP after April, and I can guarantee they are going to stick by that. For the developing world, that means where there's likely a disproportionately large XP base, the first day after support ends, those regions will be at incredible risk."

Budd expects attackers to re-engineer Windows updates, some of which will be exploitable on XP -- and he is "really worried." "We're facing an unprecedented threat environment late spring/early summer. And in the developing world, some people don't have the money to buy a new PC running Windows 8."

Another big factor hurting developing nations coming online is a lack of law enforcement addressing cybercrime, "let alone cybersecurity as a regulation [protecting] critical infrastructure," says Tom Kellermann, managing director for cyber protection at Alvarez & Marshal Global Forensic and Dispute Services. "And ISPs are popping up left and right" as the demand for Internet connectivity explodes in these nations, he says.

Kellermann says higher rates of Internet connectivity can result in more colonized infrastructure without a national cybersecurity strategy wrapped around it. "Internet penetration rates have always been viewed as a positive economic metric; however, the Internet is not pacific, and hacking has become an epidemic," he says.

The big question, of course, is how to help developing nations avoid malware and cybercrime proliferation as they grow their online presence. "We can begin to work with policymakers worldwide on how to build a business plan that's right for this country and this set of circumstances. The social and economic factors need to be aligned and the technology and skills developed," Microsoft's Nicholas says.

Microsoft didn't name names in its report, but 52 percent of the struggling nations were located in the Middle East and Africa, 21 percent in Asia/Pacific, 17 percent were in Latin America and the Caribbean, and 10 percent in Central and Eastern Europe.

They typically had low broadband speed services as well as low literacy rates and high crime per-capita. They had an average technology piracy rate of 68 percent, another big risk factor for malware, and less than 10 percent of the nations had signed international treaties or codes of conduct on cybercrime.

Microsoft plans to share its findings so that Internet build out efforts can include cybersecurity measures and training, for example. A copy of the full report is available for download here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-07
An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-service condition or code execution on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4....
PUBLISHED: 2021-05-07
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documente...
PUBLISHED: 2021-05-07
IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or cause a denial of service through username enumeration. IBM X-Force ID: 190992.
PUBLISHED: 2021-05-07
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reas...
PUBLISHED: 2021-05-07
The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0...