Microsoft Report Downplays Importance Of Zero-Day Attacks

Less than 1 percent of exploits discovered in the first half of 2011 took advantage of zero-day vulnerabilities, according to a report from Microsoft’s Trustworthy Computing group.

Social engineering, brute-force attacks and auto-run threats continue to make up the bulk of attacks enterprises are seeing on their systems and networks, according to the latest Security Intelligence Report (SIR) released October 11 by the Trustworthy Computing group at Microsoft.

Context

The six-month-long research was also presented at the RSA Conference Europe on the same day by Adrienne Hall, general manager of Trustworthy Computing.

Microsoft is not trying to give the impression that zero-day attacks aren’t a problem, or that they don’t need to be dealt with, Jeff Jones, director of security with the Trustworthy Computing group, told eWEEK. Rather, the report is intended to show that most threats are preventable and should help IT managers better assess risk and focus on how to educate users about defenses.

“We’re not saying don’t worry about zero-days, but they need to be put into context,” Jones said.

Exploits based on zero-day vulnerabilities accounted for just 0.12 percent of all exploit activity during the first half of 2011, with a peak in 0.37 percent in June, according to Microsoft researchers. The report found that social engineering attacks, such as tricking users into doing something dangerous, are far more prevalent and have more risks for the enterprise. Microsoft researchers found that 44.8 percent of all malware was spread by some form of “user interaction” and 26 percent abused the Windows “Auto-Run” feature.

The report suggested that there are plenty of vectors to distribute malware, attack networks and steal information. There is “no single technique,” according to Jones. Despite the fact that Microsoft has already released a patch to turn off Auto-Run on Windows systems, attacks exploiting the feature remain prevalent, according to the report.

Jones said Auto-Run was intended to make things more efficient, but has resulted in becoming a prime attack vector.

Flash vulnerabilities

A significant majority of the zero-days that were exploited in the first half of 2011 were related to two vulnerabilities in Adobe’s Flash Player. Adobe patched the first flaw (CVE-2011-0611) within a week of an exploit being seen in the wild. The second flaw (CVE-2011-2110) did not gain much traction among criminals until a patch had already been released. Software companies have become more responsive to zero-days and are much more aggressive about patching those issues, according to Microsoft.

Other exploits targeted vulnerabilities in the Oracle Java Runtime Environment, Java Virtual Machine and Java SE in the Java Development Kit2, the report found. Attackers are more likely to go after known vulnerabilities that administrators haven’t bothered to patch rather than going through the effort of finding and exploiting unknown security flaws, Jones said.

Zero-day attacks generally get a lot of attention and are scarier for consumers and IT professionals, Jones said. Microsoft wanted to clarify what the scope of the threat is, which is why the latest SIR focused on zero-day vulnerabilities and attacks exploiting them.

Zero-day ‘panic’

SIR will “stop management from getting panicky” about zero-day threats because administrators who work with security “day-to-day” can use the information to show senior executives what threats are most prevalent against the enterprise, according to Jones.

“The risk associated with zero-day exploits is real and should be represented in organisations’ risk management plans,” Tim Rains, director of product management for Trust Worthy Computing Communications at Microsoft, wrote in a blog.

The report is very clear about the fact that organisations running newer versions of software, and not just Microsoft products, are always better protected, Jones said. It is an “obvious call to action” to get organisations to take advantage of newer features and better protection by keeping up-to-date on software version numbers and even more so for web browsers, he added.

Previous SIRs from Microsoft focused online scams and scareware, botnets and the use of personal computers to send spam and other malware.