Microsoft report shows scareware, file-fomat bugs on rise
Rogue anti-virus, or scareware, programs -- which entice a user into purchasing fake security software by telling them their machine is infected -- has emerged as the biggest security threat facing internet users, according to Microsoft's sixth Security Intelligence Report.In the second half of last year, the seven most common families of threats removed from Windows PCs were related to scareware programs, according to the report, released Wednesday. The most common family of trojan downloaders used to distributed rogue security software, Win32/Renos, was found on 4.4 million machines, a 67 percent increase over the first half of 2008.
"What they do is take advantage of people's fears and they blast false infection messages onto the computer," Jimmy Kuo, principal architect of the Microsoft Malware Response Center, told SCMagazineUS.com this week. "It's the No. 1 issue we encounter."
Users are getting infected merely by visiting a website that has been seeded with an exploit, a ploy known as drive-by downloads, he said. The threat, though, affects more home than corporate users.
"You don't have users in the company thinking they have to pay for anti-virus software," he said. "On the other hand, corporate users will still see them while they go rummaging on the internet."
The report also analyzed file-format exploits, in which attackers distribute malicious files for programs such as Microsoft Office or Adobe Reader. The study found that 91.3 percent of file-format attacks leverage a two-year-old Word vulnerability, which was patched by MS06-027.
Kuo said this is proof that people aren't patching their systems as diligently as they should be.
"As we found out in the Conficker scenario, the corporate situation is that they obviously are aware of the patches that we issue, but most corporations have a situation where they'll run [the fixes] through tests that take a rather long time," he said. "And sometimes, they opt for not invoking [the patch because of] the potential that they'll have incompatibilities because of the patch."
The report also found that stolen equipment, such as laptops, accounted for the most common cause of data breaches; more than 97 percent of email is unwanted; the number of Microsoft security bulletins issued in the second half of 2008 rose 67.2 percent; and financial organizations and social networking sites are the most frequently targeted vertical in phishing attacks.
