Microsoft: Cybercrime Falling Into Two Distinct Camps

There are sophisticated cybercrime groups who target organizations or individuals using social engineering or rare exploits, and then there are those cybercriminals who use more widely available attack techniques aimed at a wider audience of victims. Those two approaches are the two main ways cybercrime has shaken out, according to a new report released today by Microsoft.

And unlike the cybercriminals who wage targeted attacks either for espionage, extortion, or big-ticket theft, the broad-brush attacks are all about pilfering a little money here and there from a lot of victims. These attacks are increasingly being run like marketing campaigns, according to Microsoft's new Security Intelligence Report (SIR), Volume 10, which encompasses July 2010 through December 2010.

"We're seeing a polarization of criminal behavior: There's the highly sophisticated, skilled [criminals] who create exploits and go after high-value targets using zero-day attacks, special intelligence, and customized social engineering," says Jerry Bryant, group manager of response communications for Microsoft's Trustworthy Computing Group. "The other [group] uses more accessible attack methods, using maybe the skilled ones' [malware], and social engineering methods for a larger number of people. We're seeing these attacks run more like marketing campaigns, and especially during significant events that attract media attention, such as the disaster in Japan."

Data gathered by Microsoft from more than 600 million Windows machines worldwide for the report shows how that strategy is playing out: Rogue security software was found and blocked on nearly 19 million Windows machines last year, and the top five families of this malware accounted for 13 million of those instances. FakeSpypro was the most common rogue AV in each quarter of 2010, and FakePAV -- which poses as Microsoft Security Essentials -- was the next most commonly spread fake AV in the second half of the year. "We cleaned it out over 730,000 systems," Bryant says.

And phishing attacks using social networking lures jumped a whopping 1,200 percent, from 8.3 percent of phishing in January to 84.5 percent of phishing in December. Online gaming sites are also in the phishing pool, accounting for 16.7 percent of all phishing in June, according to the report.

And pesky adware is back: Two new adware variants, Win32/ClickPotato and JS/Pornpop, came on the scene last year, sending adware up by 70 percent between the second and fourth quarters. ClickPotato pushes ads based on a user's browsing habits, while PornPop pushes adult content, Microsoft's Bryant says. "They both install without your direct permission," he says. "They try to be persistent and avoid removal, but they're not usually doing anything malicious."

The two adware families topped the list of most common threats in the report, with 11.5 percent of Windows machines harboring ClickPotato, and 7.7 percent harboring PornPop.

"Six of the top 10 malware was adware, spyware, or rogue security software. And these have the potential to lead to worse types of malware: With every one malware, there are one or two others we find as well," Bryant says.

There were some bright spots in the SIRv10 report, Bryant says: Reported vulnerabilities declined by 16.9 percent. "That's a trend we've been seeing since 2006," Bryant says. "Newer products lower infection rates: Windows 7 and 2008 have the lowest infection rates across OSes."

Not everyone agrees that fewer publicly disclosed vulnerabilities is necessarily good news. Nick Selby, managing director of PoliceLedIntelligence.com and a Texas police officer, says touting a decline in publicly disclosed vulnerabilities gives people a false sense of security. "As the malware industrial complex becomes more professional and profit-seeking, it should be no surprise to anyone that the number of public vulnerability disclosures comes down because they are making money from undisclosed vulnerabilities. It's no longer about the glory: It's the money," Selby says.

Selby says that when the bad guys discover a vulnerability, they try to exploit it. "The first call isn't to your vendor. It's to your developers," he says. "Like any for-profit, their intellectual property is a carefully guarded secret."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.