Microsoft: Worms And Rogue AV Dying, Web Threats Thriving

For the first time in nearly four years, the top malware threat plaguing enterprises is not the Conficker worm: Web-based attacks have taken over, according to new data gathered from more than 1 billion Windows machines worldwide.

IframeRef, a family of iFrame malware that infects Web servers, now holds the No. 1 spot, with a fivefold increase in the fourth quarter of 2012 alone with 3.3 million detections, according to the new Version 14 of Microsoft's Security Intelligence Report (SIR) for the second half of 2012.

"Conficker had been the No. 1 threat for the enterprise since we’ve been tracking domain-joined threats in [the second half of 2009]. In Q4, Conficker was significantly surpassed by IframeRef and was reflective of the overall impact of worms versus Web-based threats," says Holly Stewart, senior program manager for the Microsoft Malware Protection Center.

"The prevalence of IframeRef was a bit surprising," Stewart says. "I expected BlackHole [to be at the top]," she says. "But you're more likely to have a browser encounter with an iFrame redirector, so it really shot up over the past year."

The old mainstay worms, including Conficker and Autorun, dropped 37 percent from 2011 to the second half of 2012, mainly thanks to a second quarter 2011 update from Microsoft for XP and Vista and AV detections for Conficker. Stewart says Conficker had kept spreading for a while due to stolen passwords. "In the second quarter of 2012 is when Conficker started to decline, and this is a bit of a success story for IT pros. The changes they were making, [including] password security, are helping get rid of these worms," she says.

Even so, there are still users out there who don't run up-to-date antivirus programs: As a matter of fact, 2.5 out of 10 computers don't run up-to-date AV software, Microsoft's report says. And without updated AV, computers are 5.5 times more likely to get infected with malware, the report says.

"People intuitively understand the importance of locking their front doors to prevent their homes from being broken into. Computer security is no different. Surfing the Internet without up-to-date antivirus is like leaving your front door open to criminals," says Tim Rains, director of Trustworthy Computing at Microsoft. "With the release of this new research, Microsoft is urging people to make sure they have up-to-date Antivirus installed on their computers."

Interestingly, fake antivirus infections -- most commonly a consumer problem -- also began to decline over the second half of 2012. "For the first time in many years, we see a decline in the incidence of fake AV," Stewart says.

A Web Of Threats
But when one attack vector fizzles, another ignites: Microsoft's SIR shows how Web-borne attacks are on the rise, big-time.

Microsoft's findings on Web threats jives with that of Symantec's, which yesterday released its annual threat report. Symantec says Web-based attacks jumped by 30 percent last year, and the number of phishing sites posing as social networking sites exploded by 125 percent as attackers set their sights on social networks.

"These attacks silently infect enterprise and consumer users when they visit a compromised website," according to Symantec's Internet Security Threat Report 2012. "These attacks are successful because enterprise and consumer systems are not up to date with the latest patches for browser plug-ins, such as Adobe’s Flash Player and Acrobat Reader as well as Oracle’s Java platform. While a lack of attentiveness can be blamed for consumers remaining out of date, often in larger companies, older versions of these plug-ins are required to run critical business systems, making it harder to upgrade to the latest versions. Such patch management predicaments, with slow patch deployment rates, make companies especially vulnerable to Web-based attacks."

Stewart says the wave of Web attacks exploiting SQL injection and cross-site scripting flaws in websites during the past year contributed to some of the spikes in these attack numbers.

Seven of the top 10 threats discovered most on enterprise machines have Web threat ties, Stewart notes. "They are either a Web threat themselves or are known to be delivered through a Web threat in compromised websites, malicious websites, or a combination," she says. "Two are related to iFrame redirection, which is the middleman of Web-based attacks."

After Iframe Ref, the top malware families found in enterprises in the second half of last year were, in order, Conficker, Keygen, Autorun, Blacole, BlacoleRef, Zbot, Sirefef, Dorkbot, and Pdfjsc.

The IframeRef Trojan was found in 2.3 percent of machines in the first quarter of last year, and 13.6 percent by the fourth quarter.

Microsoft's SIR v14 drew data from 1 billion computers in more than 100 countries and regions, up from 600 million machines last year. The full SIR is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.