Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/12/2011
07:42 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Microsoft: Cybercrime Falling Into Two Distinct Camps

New Microsoft Security Intelligence Report outlines 'marketing campaign' strategies being employed by one group, and related rise in phishing and rogue antivirus software.

There are sophisticated cybercrime groups who target organizations or individuals using social engineering or rare exploits, and then there are those cybercriminals who use more widely available attack techniques aimed at a wider audience of victims. Those two approaches are the two main ways cybercrime has shaken out, according to a new report released today by Microsoft.

And unlike the cybercriminals who wage targeted attacks either for espionage, extortion, or big-ticket theft, the broad-brush attacks are all about pilfering a little money here and there from a lot of victims. These attacks are increasingly being run like marketing campaigns, according to Microsoft's new Security Intelligence Report (SIR), Volume 10, which encompasses July 2010 through December 2010.

"We're seeing a polarization of criminal behavior: There's the highly sophisticated, skilled [criminals] who create exploits and go after high-value targets using zero-day attacks, special intelligence, and customized social engineering," says Jerry Bryant, group manager of response communications for Microsoft's Trustworthy Computing Group. "The other [group] uses more accessible attack methods, using maybe the skilled ones' [malware], and social engineering methods for a larger number of people. We're seeing these attacks run more like marketing campaigns, and especially during significant events that attract media attention, such as the disaster in Japan."

Data gathered by Microsoft from more than 600 million Windows machines worldwide for the report shows how that strategy is playing out: Rogue security software was found and blocked on nearly 19 million Windows machines last year, and the top five families of this malware accounted for 13 million of those instances. FakeSpypro was the most common rogue AV in each quarter of 2010, and FakePAV -- which poses as Microsoft Security Essentials -- was the next most commonly spread fake AV in the second half of the year. "We cleaned it out over 730,000 systems," Bryant says.

And phishing attacks using social networking lures jumped a whopping 1,200 percent, from 8.3 percent of phishing in January to 84.5 percent of phishing in December. Online gaming sites are also in the phishing pool, accounting for 16.7 percent of all phishing in June, according to the report.

And pesky adware is back: Two new adware variants, Win32/ClickPotato and JS/Pornpop, came on the scene last year, sending adware up by 70 percent between the second and fourth quarters. ClickPotato pushes ads based on a user's browsing habits, while PornPop pushes adult content, Microsoft's Bryant says. "They both install without your direct permission," he says. "They try to be persistent and avoid removal, but they're not usually doing anything malicious."



Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
White Papers
More White Papers
Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-40865
PUBLISHED: 2021-10-25
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x use...
CVE-2021-25977
PUBLISHED: 2021-10-25
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
CVE-2021-35231
PUBLISHED: 2021-10-25
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHIN...
CVE-2021-38294
PUBLISHED: 2021-10-25
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
CVE-2021-40526
PUBLISHED: 2021-10-25
Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead t...