Tag Archives: Microsoft security

Microsoft, Tech, Windows 8

Is Windows 8 really a sitting duck for malware?

Leave a comment

A report claims so, but given Microsoft’s attempts to harden the OS, that seems dubious.

A new report released by the security firm Websense Security Labs claims Windows 8 will become one of the top three most-hacked platforms in 2013 because of its newness and Microsoft’s efforts to encourage development for the radical new platform.

Yeah, that didn’t make sense to me, either.

It took a chat with the folks at Websense to make, er, sense of what they were saying, but I do see their point. With a new operating system on the market that will hopefully gain significant ground and Microsoft attempting to woo developers like never before, there’s lots of potential for exploit.

“Microsoft’s efforts to produce an extremely developer friendly platform will be embraced by the cybercriminal community, and vulnerabilities will be exploited,” the company said in its 2013 Security Predictions. “If they deliver on their promise, the rate of threat growth on Microsoft mobile devices will be the highest.”

That’s a big “if.” Android, another platform Websense sees as a major target in 2013, is far more insecure. But in the case of Windows, there is, for lack of a better word, an installed base of malicious code and talent who know their way around Windows operating systems, and they are going to bring that to bear on Windows 8.

They will try to get around security systems that have been tightened up. Good luck with that. BitDefender recently ran tests on Windows 8 and found that a system with just Windows Defender, which is hardly a suitable security program, stopped 85% of the malware samples used in the tests.

The bad guys aren’t just about code; they understand how people write code and how malware works. So it’s not just malware samples, it’s accumulated and applied knowledge that they bring to Windows 8, says Websense. And given the common code between PC Windows 8 and Windows Phone 8, malware could easily move across platforms.

The other two platforms that will be big targets in 2013 are also mobile operating systems: Android and iOS. According to the firm, Android will be targeted because of its open nature. Websense expects attack techniques used on the desktop platform to continue to migrate over to Google’s operating system.

iOS should be a lot more stable due to its closed nature. However, with the growing popularity of iOS devices in professional environments, IT should consider this a prime platform for targeted attacks, Websense said. And most malware that does exist for iOS targets jailbroken phones.

Websense made seven predictions for 2013, most of them centered around cybercriminals attacking mobile devices. You can find the entire report, in PDF format, here. Free registration is required to view it.

 

 

MCTS Training, MCITP Trainnig

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

 

 

Microsoft, Tech

Microsoft Says Recovery from Malware Becoming Impossible

A Microsoft security official recommends that big businesses invest in an automated process to wipe hard drives and reinstall malware-infested operating systems.
Microsoft Says Recovery from Malware Becoming Impossible
( Page 1 of 2 )

LAKE BUENA VISTA, Fla.—In a rare discussion about the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.
MCTS Training, MCITP Trainnig

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com
“When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit,” Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Offensive rootkits, which are used hide malware programs and maintain an undetectable presence on an infected machine, have become the weapon of choice for virus and spyware writers and, because they often use kernel hooks to avoid detection, Danseglio said IT administrators may never know if all traces of a rootkit have been successfully removed.

He cited a recent instance where an unnamed branch of the U.S. government struggled with malware infestations on more than 2,000 client machines. “In that case, it was so severe that trying to recover was meaningless. They did not have an automated process to wipe and rebuild the systems, so it became a burden. They had to design a process real fast,” Danseglio added.

Danseglio, who delivered two separate presentations at the conference—one on threats and countermeasures to defend against malware infestations in Windows, and the other on the frightening world on Windows rootkits—said anti-virus software is getting better at detecting and removing the latest threats, but for some sophisticated forms of malware, he conceded that the cleanup process is “just way too hard.”

Microsoft says stealth rootkits are bombarding Windows XP SP2 machines. Click here to read more.

“Weve seen the self-healing malware that actually detects that youre trying to get rid of it. You remove it, and the next time you look in that directory, its sitting there. It can simply reinstall itself,” he said.

“Detection is difficult, and remediation is often impossible,” Danseglio declared. “If it doesnt crash your system or cause your system to freeze, how do you know its there? The answer is you just dont know. Lots of times, you never see the infection occur in real time, and you dont see the malware lingering or running in the background.”

He recommended using PepiMK Softwares SpyBot Search & Destroy, Mark Russinovichs RootkitRevealer and Microsofts own Windows Defender, all free utilities that help with malware detection and cleanup, and urged CIOs to take a defense-in-depth approach to preventing infestations.

Are virtual machine rootkits the next big threat? Click here to read more.

Danseglio said malicious hackers are conducting targeted attacks that are “stealthy and effective” and warned that the for-profit motive is much more serious than even the destructive network worms of the past. “In 2006, the attackers want to pay the rent. They dont want to write a worm that destroys your hardware. They want to assimilate your computers and use them to make money.

“At Microsoft, we are fielding 2,000 attacks per hour. We are a constant target, and you have to assume your Internet-facing service is also a big target,” Danseglio said.

 

MCTS Training, MCITP Trainnig

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com