High Quality
Open the downloaded document, and select print from the file menu (PDF reader required).
Microsoft Security Intelligence Report
Volume 7January through June 2009
Microsoft Security Intelligence Report
Microsoft Security Intelligence Report
Te inormation contained in this document represents the current view o Microso Corporation on the issues discussed as o the dateo publication. Because Microso must respond to changing marketconditions, it should not be interpreted to be a commitment on thepart o Microso, and Microso cannot guarantee the accuracy o any inormation presented aer the date o publication.Tis document is or inormational purposes only. MICROSOFMAKES NO WARRANIES, EXPRESS, IMPLIED, OR SAU-ORY, AS O HE INFORMAION IN HIS DOCUMEN.Complying with all applicable copyright laws is the responsibility o the user. Without limiting the rights under copyright, no part o this document may be reproduced, stored in or introduced into aretrieval system, or transmitted in any orm or by any means (elec-tronic, mechanical, photocopying, recording, or otherwise), or orany purpose, without the express written permission o MicrosoCorporation.Microso may have patents, patent applications, trademarks, copy-rights, or other intellectual property rights covering subject matterin this document. Except as expressly provided in any written licenseagreement rom Microso, the urnishing o this document doesnot give you any license to these patents, trademarks, copyrights, orother intellectual property.Copyright © 2009 Microso Corporation. All rights reserved.Microsot, the Microsot logo, ActiveX, AppLocker, Bing, theBing logo, BitLocker, Excel, Foreront, Hotmail, Internet Explorer,OneCare, Outlook, PowerPoint, the Security Shield logo,SmartScreen, SQL Server, Visual Basic, Visual Studio, Windows,the Windows Logo, Windows Live, Windows Media, Windows Server,and Windows Vista are either registered trademarks or trademarkso Microso Corporation in the United States and/or other coun-tries. Te names o actual companies and products mentionedherein may be the trademarks o their respective owners.
January through June 2009
Authors
Richard Boscovich
Microso Internet Saety and Enorcement eam
J Campana
Microso Internet Saety and Enorcement eam
Darren Canavor
Microso Security Engineering Center
Bruce Dang
Microso Security Engineering Center
Joe Faulhaber
Microso Malware Protection Center
Vinny Gullotto
Microso Malware Protection Center
Yuhui Huang
Microso Malware Protection Center
Je Jones
Microso rustworthy Computing
John Lambert
Microso Security Engineering Center
ony Lee
Microso Malware Protection Center
Ziv Mador
Microso Malware Protection Center
Ritesh Mordani
Microso Foreront Online Protection orExchange
Bala Neerumalla
Microso Secure SQL Initiative eam
Jonathan Ness
Microso Security Engineering Center
Hamish O’Dea
Microso Malware Protection Center
Sasi Parthasarathy
Bing
Anthony Penta
Microso Windows Saety Platorm
Contributors
Fred Aaron
Microso Security Engineering Center
Charles Anthe
Online Management Platorm & Solutions
Kai Axord
Microso rustworthy Computing
Doug Cavit
Microso rustworthy Computing
Nicola Cowie
Microso Security Engineering Center
Dave Forstrom
Microso rustworthy Computing
Heather Goudey
Microso Malware Protection Center
Michael Grady
Microso rustworthy Computing
Roger Grimes
Microso I Inormation Security
Satomi Hayakawa
Japan Security Response eam
Sue Hotelling
Microso Internet Saety and Enorcement eam
Aaron Hulett
Microso Malware Protection Center
Japan Security Response eam
Microso Japan
Jeannette Jarvis
Microso Customer Support Services
Jimmy Kuo
Microso Malware Protection Center
Kathy Lambert
Microso Legal and Corporate Aairs
Jimin Li
Online Management Platorm & Solutions
Ken Malcolmson
Microso rustworthy Computing
Scott Molenkamp
Microso Malware Protection Center
Patrick Nolan
Microso Malware Protection Center
Price Oden
Microso I Inormation Security
Ina Ragragio
Microso Malware Protection Center
im Rains
Microso rustworthy Computing
Mike Reavey
Microso Security Response Center
Marc Seineld
Microso Malware Protection Center
Jinwook Shin
Microso Security Engineering Center
Sam Salhi
Microso Windows Saety Platorm
Matt Tomlinson
Microso Security Engineering Center
Alan Wallace
Microso rustworthy Computing
Je Williams
Microso Malware Protection Center
Paul Pottor
Windows Consumer Product Management
Sterling Reasor
Microso Malware Protection Center
Christian Seiert
Bing
Adam Shostack
Microso Security Engineering Center
George Stathakopoulos
Microso Security Response Center
Adrian Stone
Microso Security Response Center
Scott Wu
Microso Malware Protection Center
erry Zink
Microso Foreront Online Protectionor Exchange
External Contributors
Andre DiMino
Shadowserver Foundation
Paul Henry
echnical Writer
Hans-Peter Jedlicka
Federal Oce or Inormation Saety, Germany
Leon Aaron Kaplan
National Computer Emergency Response eamo Austria
Huopio Kauto
Computer Emergency Response eamCommunications Regulatory Authority, Finland
Hideaki Kobayashi
Inormation-echnology Promotion Agency, Japan
oshiaki Kokado
Inormation-echnology Promotion Agency, Japan
Erka Koivunen
Computer Emergency Response eamCommunications Regulatory Authority, Finland
Richard Perlotto
Shadowserver Foundation
orsten Voss
DFN-CER, Germany
Sections
« prev | next »- Authors
- Contributors
- About This Report
- Scope
- Reporting Period
- Conventions
- Data Sources
- Executive Foreword
- Trustworthy Computing: Security Engineering at Microsoft
- Melissa Plus 10: Keeping People Safe in the Age of Malware
- Ten Years of Malware and Security Threats, 1999–2009
- Computer Security Today: Working Together to Close the Gap
- Case Study: The Conficker Working Group
- Strategies, Mitigations, and Countermeasures
- Microsoft Malware Protection Center
- Malware and Potentially Unwanted Software Trends
- Threat Naming Conventions
- Infection Rates and CCM
- Geographic Trends
- Best Practices Around the World
- Category Trends
- Operating System Trends
- Malware and Potentially Unwanted Software Families
- User Reaction to Alerts
- Trends in Sample Proliferation
- Threats at Home and in the Enterprise
- Malware and Signed Code
- Threat Combinations
- E-Mail Threats
- Spam Trends and Statistics
- Geographic Origins of Spam Messages
- Reputation Hijacking
- Malware in E-Mail
- A Defense-in-Depth Strategy for E-Mail
- Malicious Web Sites
- Analysis of Phishing Sites
- Analysis of Malware Hosts
- “Malvertising”: An Emerging Industry Threat
- Top Malware and Spam Stories of 1H09
- Win32/Conficker Update
- What Happened on April 1?
- Rogue Security Software Still a Significant Threat
- Automated SQL Injection Attacks
- Win32/Koobface Attacks Social Networks
- The Win32/Waledac Botnet and Spam
- Rogue ISP 3FN Taken Down
- Prolific Spammer Alan Ralsky Pleads Guilty
- Microsoft Security Engineering Center
- Exploit Trends
- Top Browser-Based Exploits
- Analysis of Drive-By Download Pages
- Document File Format Exploits
- Security Breach Trends
- Social Security Numbers and Confidentiality
- Guidance for Organizations: Protecting Against a Data Breach
- Microsoft Security Response Center
- Industry-Wide Vulnerability Disclosures
- Vulnerability Disclosures
- Vulnerability Disclosure Date vs. Publication Date
- Vulnerability Severity
- Vulnerability Complexity
- Operating System and Browser Vulnerabilities
- Vulnerability Reports for Microsoft Products
- Responsible Disclosures
- Microsoft Security Bulletins in 1H09
- More Vendors Adopting Scheduled Release Strategies
- Exploitability Index
- Usage Trends for Windows Update and Microsoft Update
- Update Clients and Services
- The Role of Automatic Updating
- Regional Variations in Update Service Usage
- Afterword
- Call to Action: End to End Trust
- Appendixes
- Appendix A: Full Geographic Data
- Appendix B: Threat Assessments for Individual Locations
- Australia
- Brazil
- China
- France
- Germany
- Japan
- Korea
- Malaysia
- Norway
- Russia
- South Africa
- United Kingdom
- United States
- Appendix C: Data Sources
- Microsoft Products and Services
- Software Vulnerability and Breach Data
- Appendix D: Microsoft Security Bulletins in 1H09
- botnet
- clean
- cross-site scripting
- See password stealer (PWS)
- malware impression
- monitoring tool
- parser vulnerability
- password stealer (PWS)
- phishing impression
- responsible disclosure
- trojan downloader/dropper
Add a Comment