Windows 7 virus infection rates up during the second half of 2010
May 13, 2011
According to official statistics from Microsoft, Windows 7 virus and malware infection rates increased during the second half of last year, even as virus hit rates on XP computers actually declined.
The latest edition of Microsoft's Security Intelligence Report shows an infection rate of about 0.4 percent of all Windows 7 PCs in the second half of last year. That's up from 0.3 percent of all computers during the first six months of 2010.
The increase of more than 30 percent compares with a decrease of the infection rates, albeit from a much higher starting point for older and less secure computers running Windows XP.
Both numbers were taken from scans using Microsoft's Malicious Software Removal Tool (MSRT).
Infection rates for Windows XP SP-3 machines fell from around 1.8 percent to 1.4 percent. PCs running XP SP-3 actually fared better than machines running only XP SP-2, where infection rates dropped from around 0.2 percent to 0.18 percent over the same period.
Overall infection rates on Vista computers also dropped from around 0.11 percent 0.10 percent or even slightly less, for computers running SP2.
As Microsoft points out, Windows 7 PCs have more built-in security protection and are more immune from security attacks than machines running Vista or Windows XP. But this security performance boost is decreasing, possibly as a result in a change of tactics by virus and malware-peddling attackers.
The software giant recorded a massive fourteen-fold rise in Java-based attacks during the third quarter of last year, as miscreants sought to exploit two vulnerabilities prevalent at that time. Those two vulnerabilities (CVE-2008-5353 and CVE-2009-3867) accounted for 85 percent of all Java exploits detected in the second half of 2010.
Operating system exploits, which have declined over recent months, increased significantly in the third quarter of last year, primarily because of exploitation of two Windows security vulnerabilities, Microsoft noted.
The same period also witnessed an enormous increase of 1,200 percent in phishing attacks using social networking as the bait, as social networks become lucrative areas for increased criminal activity as of late.
Overall, phishing attacks using social networking as bait increased from a low of 8.3 percent of all attacks in January 2010 to a high of 84.5 per cent in December of the same year.
Additionally, the Security Intelligence Report also charts a big increase in adware-based attacks as well. Two new strains of adware, JS/Pornpop and Win32/ClickPotato were also major contributors to this increase.
Both strains of virus and malware generate pop-ups on infected computers. In the case of Pornpop, those pop-ups advertise pornographic sites.
Microsoft's 89-page PDF report can be downloaded on its website.
In other Internet security news
Internet security experts say they've discovered numerous security flaws in most of the popular file hosting sites that allow people to gain unauthorized access to data that's supposed to be available only to those selected by the user.
Get the best Linux or Windows Web hosting plan for your website.
The Internet security experts include Nick Nikiforakis, Steven Van Acker, Wouter Joosen, of the Katholieke Université de Leuven in Belgium, then Marco Balduzzi and Davide Balzarotti of the Institute Eurecom in France.
Those file hosting services, which include sites such as RapidShare, FileFactory and EasyShare, allow users to upload large files and make them available to anyone who knows the unique URI (Uniform Resource Identifier) that's bound to each one.
Internet users can post the link on websites, in emails or on forums available to the public. For example, RapidShare says it can be used to share your data with your friends, colleagues or family.
But according to research academics in Belgium and France, a significant percentage of the 100 FHSs (File Hosting Services) they've studied made it very easy for outsiders to access the files simply by guessing the URLs that are bound to each uploaded file.
Making an already bad situation even worse, they presented more evidence that such Internet attacks, far from being theoretical, are already happening in the wild, and with increased frequency.
The academic researchers said they developed some software and then 'trained' web crawlers on the file services and uncovered hundreds of thousands of private files in just two weeks. They also used the file hosting sites to store private files that contained Internet beacons, so they'd know if anyone opened them. Over a month's span, no less than 80 unique IP addresses accessed the so-called "honey files" 275 times, indicating that the weakness is already being exploited in the wild to harvest data many users believe isn't available for general viewing or utilization.
“These so-called file hosting services adopt a security-through-obscurity mechanism where a user can access the uploaded files only by knowing the correct download URIs,” the researchers wrote in a paper presented at the most recent USENIX Workshop on Large-Scale Exploits and Emergent Threats.
“While these services claim that these URIs are secret and cannot be guessed, our study shows that this is far from being true,” said the researchers.
The security flaws that were the easiest to exploit were found on hosting sites that use sequential identifiers in the download URIs. By writing scripts that enumerate the IDs character by character, their bot crawler was able to locate almost 311,000 unique files over a period of just 30 days. The researchers then ran searches on Microsoft's Bing.com search engine to arrive at an estimate of 168,320 or 54 percent of them, were private files because they hadn't been shared online, at least not yet.
“Unfortunately, the security issues are extremely serious since the list of insecure FHSs using sequential IDs also include some of the most popular names, often highly ranked by Alexa in the list of the top Internet websites,” the researchers wrote.
But in an effort to prevent their findings from being abused, their report didn't say which specific sites are the most vulnerable to various types of attacks.
Another common security flaw involved the use of pseudorandom URIs for each uploaded file. By using brute-force attacks that cycled through every possible known combination, the researchers were able to successfully guess a file's unique ID 1.1 times for every thousand attempts. Part of the weakness is the result of websites that used IDs that consisted of only numeric strings with a maximum length of six numbers. But even when services used IDs with alphanumeric characters or numbers with a length of 8, the researchers achieved similar success at penetration rates.
In other instances, some file hosting services used ID systems with enough complexity that rendered brute-force techniques ineffective or used CAPTCHAs (user-graphic input identifier boxes) or other mitigations.
However, and in many cases, the researchers were often able to guess the names anyway by simply exploiting a directory traversal vulnerability in a commonly-used web hosting program used by most file sharing services.
You can link to the Internet Security web site as much as you like.