Tag Archives: Malware

Adrienne Hall, general manager, Trustworthy Computing (TwC) announced the release of our bi-annual Security Intelligence Report (SIRv13) and a new free Cloud Security Readiness Tool at RSA Europe in London on the 9^th of October 2012. The global threat landscape is evolving. Malware and potentially unwanted soft-ware have become more regional, and different locations around the world exhibit different threat patterns. The Security Intelligence Report website at www.microsoft.com/sir has more information about threats in South Africa and around the world, and explains the methods and terms used. Tim Rains, Director, Trustworthy Computing, Microsoft Corporation provides a summary of the SIR v13 findings below.

Worldwide trends

Cybercriminals are gravitating towards Software Activation Key Generators as a way to trick users into installing malware. This emerging social engineering tactic was the number one threat facing consumers worldwide during the 1^st half of 2012. Application vulnerabilities accounted for 71.6% of all disclosures in 1H12. An alarming trend we observed was the increasing rate that attackers are using software activation key generators to distribute their evil wares to the unsuspecting. Detection of malware connected to key generators was seen over five million times in the first six months of this year.

Blacole was the most commonly detected exploit family in 1H12 with almost 6 million detections. Blacole, a family of exploits, is commonly referred to as the “Blackhole” exploit kit that is used to deliver malicious software through infected webpages. Windows 7 users were 20% more likely than Windows XP users to have Windows updates installed, 40% more likely to have Microsoft Word security updates installed, 37% more likely to have Adobe Reader updates installed, and 60% more likely to have Oracle Java updates installed. This may be one reason why the number of computers cleaned per thousand (CCM) is lower in Windows 7 when compared to previous versions of Windows.

The number of threats detected/blocked in the US spiked over 32% from Q1 to Q2 2012. This was primarily driven by rogue security software called Win32/FakePAV. Detections of Win32/FakePAV increased by 30% between 1Q12 and 2Q12, making it the most commonly detected rogue security software family overall during the first half of the year.

Korea’s CCM increase from 27.5 in 1Q12 to 70.4 in 2Q12 is one of the largest quarter-to-quarter increases ever reported for a large country or region in the Microsoft Security Intelligence Report. The change was primarily caused by increased detection of the trojan downloader family Win32/Pluzoks. Conficker was the number one threat facing enterprises/businesses for the past few years. It has since moved to the number two threat facing enterprises/businesses and the threat JS/IframeRef has moved to the number one spot.

Since 2008, worldwide usage of Windows Update and Microsoft Update has increased by 60%.

This report is accompanied by a release in late July at Black Hat USA 2012, of the latest MSRC Progress Report –“Building a Safer, More Trusted Internet Through Information Sharing”  which includes:

• Updated Microsoft Security Bulletin statistics covering the past year
• A behind-the-scenes look at what goes into an out-of-band security bulletin
• Year over year progress within the Microsoft Active Protections Program, Microsoft Exploitability Index, and Microsoft Vulnerability Research initiatives
• An update on the Microsoft BlueHat Prize Contest announced last year
• Results of a study on the efficacy of the Enhanced Mitigation Experience Toolkit (EMET)

Introduction to Designing Reliable Cloud Services

In mid-September, Microsoft released An introduction to designing reliable cloud services—a new white paper outlining a process to help organizations create, deploy and/or consume cloud services, This paper aims to be a catalyst for further discussions among services teams, organizations, and the industry itself. The Cloud Security Readiness Tool helps companies start a conversation about effective cloud services with a very small time investment to get results. The Cloud Security Readiness Tool moves the conversation from feature comparison, to critical base issues that must be addressed for success. The tool helps takes a process frequently performed as a pre-consulting effort that can take anywhere from several days to weeks and converts it into a short 15 minute effort. The results can help ensure that customers have information they need to able to conduct intelligent well-formed discussions from day one.

South Africa’s Threat Intelligence

The Microsoft Malicious Software Removal Tool (MSRT) detected malware on 6.9 of every 1,000 computers scanned in South Africa in 2Q12. The figure below shows the computers cleaned per mile (CCM) trend for South Africa over the last four quarters, compared to the world as a whole. The MSRT detected malware with a CCM score of 6.9, compared to the 2Q12 worldwide average CCM of 7.0.

Threat categories

The figure above shows the malware and potentially unwanted software categories in SA in the second quarter of 2012 (2Q12). Worms are still the most common category in SA in 2Q12. It affected 42.5% of all computers with detections, down from 43.1% in 1Q12. The second most common category was Miscellaneous Potentially Unwanted Software. It affected 31.3% of all computers with detections, up from 30.2% in 1Q12. The third most common category was Miscellaneous Trojans, which affected 28.1% of all computers with detections, up from 24.9% in 1Q12. Totals exceed 100 percent because some computers are affected by more than one kind of threat.

Threat families

The figure above shows the top 10 malware and potentially unwanted software families in South Africa in 2Q12. The most common threat family in SA in 2Q12 was Win32/Autorun, which affected 17.9% of computers with detections here. Win32/Autorun is a family of worms that spreads by copying itself to the mapped drives of an infected computer. The mapped drives may include net-work or removable drives. The second most common threat family in SA in 2Q12 was Win32/Vobfus, which affected 12.8% of computers with detections in SA. Win32/Vobfus is a family of worms that spreads via network drives and removable drives and download/executes arbitrary files. Downloaded files may include additional malware. The third most common threat family in SA in 2Q12 was Win32/Keygen, which affected 9.2% of computers here. Win32/Keygen is a generic detection for tools that generate product keys for various software products. The fourth most common threat family in SA in 2Q12 was Win32/Rimecud, which affected 8.5% of computers with detections in South Africa. Win32/Rimecud is a family of worms with multiple components that spread via fixed and removable drives and via instant messaging. It also contains backdoor functionality that allows unauthorized access to an affected system.

Malicious Websites

Attackers often use websites to conduct phishing attacks or distribute malware. Malicious websites typically appear completely legitimate and often provide no outward indicators of their malicious nature, even to experienced computer users. In many cases, these sites are legitimate websites that have been compromised by malware, SQL injection, or other techniques, in an effort by attackers to take advantage of the trust users have invested in them. To help protect users from malicious webpages, Microsoft and other browser vendors have developed filters that keep track of sites that host malware and phishing attacks.

Note: To provide a more accurate perspective on the phishing and malware landscape, the methodology used to calculate the number of Internet hosts in each country or region has been revised. For this reason, the statistics presented here should not be directly compared to findings in previous volumes.

Web browsers such as Windows Internet Explorer and search engines such as Bing use lists of known phishing and malware hosting websites to warn users about malicious websites before they can do any harm. The information presented in this section has been generated from telemetry data produced by Internet Explorer and Bing.

Update Service Usage

Microsoft provides several tools and services that enable users to download and install updates directly from Microsoft or from update servers designated by their system administrators. The update client software (called Automatic Updates in Windows XP and Windows Server 2003, and simply Windows Update in other currently supported versions of Windows) connects to an update service for the list of available updates. After the update client determines which updates are applicable to the user’s computer, it installs the updates or notifies the user that they are available, depending on the way the client is configured and the nature of each update.

For end users, Microsoft provides two update services that the update clients can use:

• Windows Update provides updates for Windows components and for device drivers provided by Microsoft and other hardware vendors. Windows Update also distributes signature updates for Microsoft antimalware products and the monthly release of the MSRT. By default, when a user enables automatic updating, the update client connects to the Windows Update service for updates.
• Microsoft Update provides all of the updates offered through Windows Update and provides updates for other Microsoft software, such as the Microsoft Office system, Microsoft SQL Server, and Microsoft Exchange Server. Users can opt in to the service when installing software that is serviced through Microsoft Update or at the Microsoft Update Web site (update.microsoft.com/microsoftupdate). Microsoft recommends configuring computers to use Microsoft Update instead of Windows Update to help ensure they receive timely security updates for Microsoft products.

Enterprise customers can also use Windows Server Update Services (WSUS) or the Microsoft System Center family of management products to provide update services for their managed computers.

This chart above shows the growth in the number of computers connecting to Windows Update and Microsoft Update in South Africa over the last four years, indexed to the total usage for both services in SA in 2008.  In 2012, the number of computers connecting to Windows Update and Microsoft Update in SA was up 7.0% from 2011, and up 56.5% from 2008. By comparison, worldwide use of the two services increased 18.3% between 2011 and 2012, and 59.7% from 2008 to 2012. Of the computers using the two update services in SA in 2012, 61.1% were configured to use Microsoft Update, compared to 58.5% worldwide.

In Conclusion

• Avoid downloading Pirated Software
• When browsing for software, audio or video files, do so from a trusted source. When getting software updates, get them from a trusted source. In the event a trusted vendor has automatic updating, take advantage of the services. For Microsoft products, turn on Microsoft Update. Using Internet Explorer with SmartScreen enabled can protect from malicious downloads. You can save yourself, your coworkers, and your family and friends a lot of hassle and money by procuring software from the original manufacturer.
• When browsing for software, audio or video files, do so from a trusted source. In particular,make sure to download any free software only from the original vendor. When getting software updates, get them from a trusted source. In the event a trusted vendor has automatic updating, take advantage of the services. For Microsoft products, turn on Microsoft Update. Using Internet Explorer with SmartScreen enabled can protect from malicious downloads. You can save yourself, your coworkers, and your family and friends a lot of hassle and money by procuring software from the original manufacturer.
• Use Microsoft Update, not Windows Update
• Implement Secure Development Practices
• Educate Yourself & Your Customers; Keep Your Systems Up to Date
• Consider the Cloud
• Establish National and Cluster CSIRTs

In addition to above practices, we also recommend:

Prevention

• Enable a firewall on your computer.
• Get the latest computer updates for all your installed software.
• Use up-to-date antivirus software.
• Limit user privileges on the computer.
• Use caution when opening attachments and accepting file transfers.
• Use caution when clicking on links to web pages.
• Use a trusted supply chain to obtain your software, music or videos.
• Protect yourself against social engineering attacks.
• Use strong passwords.

Recovery

To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:

• Microsoft Security Essentials
• Windows Defender
• Microsoft Safety Scanner
• Windows Defender Offline

If you suspect a site may contain pirated software, report the site to the manufacturer for investigation.