"We are aware of this industry-wide social engineering technique that requires user interaction to run a malicious application," according to Microsoft's statement. "This is not a vulnerability, as someone must be convinced to visit a malicious site and take additional action, such as using a keyboard shortcut to execute the malicious application. Smart Screen will help mitigate the risk for customers running Internet Explorer. We continue to encourage customers [to] exercise caution when visiting untrusted websites."
But Valotta said Microsoft's Smart Screen technology isn't infallible. "There are a lot of ways to circumvent Smart Screen," he said. One technique would be to use a stolen extended validation signing certificate to give the malware a good reputation. Another technique is to use extweets -- shortened URLs made to link to malicious executables -- of which Valotta said about 20% don't appear to be on Microsoft's list of bad code, or classified as malware by Virus Total.
How might Microsoft or Google lock down Windows or their respective browsers to block these types of attacks? Valotta offered several recommendations, including altering browsers so that any notifications tied to background windows be brought to the front after a preset period of delay, as well as disabling use of the tab key in notification windows and ensuring that all important notifications -- for example, file-download alerts -- are displayed in a static browser frame that can't be hidden in a pop-under window.