Microsoft has released the latest edition of its twice-annual Security Intelligence Report, its survey of the security landscape and threats around the world. The survey has a ton of data about what malware is infecting people, which parts of the world are seeing increased attacks, and more.
For the first time, this report includes data that Microsoft has collected from its cloud operations. Azure Active Directory, handling logins for corporate Office 365 customers, has some 550 million users across 8.24 million customers and handles 1.3 billion logins a day. The Microsoft Account system used for consumer products handles more than 13 billion logins per day.
This generates a ton of data, and Microsoft uses this data in machine learning systems to build models of what normal user behavior looks like and detect anomalies. Capabilities like this are used in the new Windows Defender Advanced Threat Protection, and today's SIR gives some quantification to them.
Many of the login attempts are fraudulent. Often the fraudulent login attempts won't have the right username or password, but that's not always the case; credentials are often phished or compromised when people re-use the same username and password on multiple systems. The heuristics can detect these anomalous logins by noticing, for example, an unusual time of day or country and trap these attempts to break into an account. Accounts that are believed to be compromised are forced into a two-factor authentication process, with Microsoft saying that more than 10 million login attacks are trapped each day, millions of which use the right password but fail the second factor test.
IP addresses that repeatedly attempt fraudulent logins to Microsoft Accounts are blocked. Forty-nine percent of all blocked addresses originate in Asia, with South America in second place at 20 percent.
The data Microsoft collects shows some striking differences between systems that are managed by an IT department (using membership of a Windows domain to indicate this) and those that aren't. Managed systems are much less likely to encounter malware, with about 11 percent of domain-joined PCs encountering malware in the fourth quarter, compared to about 22 percent of non-domain-joined systems. The report categorizes malware into different types such as adware, viruses, worms, trojans, and unwanted browser plugins; unmanaged PCs saw more of every single type of malware, except one. Ransomeware was slightly more common on the managed PCs. Targeted ransomware attacks aiming at hospitals have wreaked havoc lately, and the financial rewards may make aiming at enterprise targets more attractive than victimizing home users.
There are some oddities within the data. The second most commonly found malware family was an exploit for Windows that's known as CplLnk. This attacks a flaw in the way that Windows handles shortcut files, permitting an attacker to automatically execute a program of their choosing whenever they attach an infected USB stick to their system. CplLnk became widely known as one of the zero-day flaws used by Stuxnet, the malware believed to have been written by US and Israeli intelligence services to attack the Iranian nuclear effort. The flaw was fixed by Microsoft way back in 2010, and Windows 8 and Windows 10 have never been susceptible to it. As such, there shouldn't be any systems that can be exploited with this flaw. Its continued detection in the wild indicates that for some reason, malware authors are continuing to find it a useful part of their toolkit.
Most systems that Microsoft has telemetry data for have permanent antimalware protection, either from Microsoft or third parties. About a quarter of PCs either lack protection entirely or have only sporadic protection. Among systems cleaned of malware, systems with permanent antimalware protection were half as common as those with no or intermittent protection. This isn't a perfect measure, as in some cases malware may disable antimalware software, but it's suggestive that having effective and up-to-date antimalware software provides a meaningful reduction in malware infections. Traditionally, many self-styled power users have argued that common sense computing practices and good sense can be ample protection from malware. This may not be true in practice, and it looks like the software does in fact make a difference.
Listing image by Aurich Lawson / Thinkstock
reader comments
60