Badge technology blog

Botnets form 'black cloud' but PC users slightly safer, says Microsoft

Microsoft's Security Intelligence Report shows slight decline in the number of software vulnerabilities, but plenty of attempts to exploit them
Table and pie-chart of the leading malware threats in the UK
The leading malware threats in the UK Source: Microsoft UK

The number of software vulnerabilities has gone down again, by 8.4% to about 2,500, according to the eighth edition of Microsoft's Security Intelligence Report (SIRv8), which is published twice a year. The latest edition was published today at

However, botnets continue to be a problem as they are hired out by cybercriminals in what Cliff Evans, Microsoft UK's head of security and privacy, calls a "black cloud". He says that in the second half of 2009, the top five botnets were responsible for sending more than 94% of all botnet spam.

Attacks are now motivated by financial gain, with a "black economy" of malware authors, botnet herders and other criminals working together to exploit vulnerabilities in Windows PCs.

As before, the numbers show that more recent versions of Microsoft Windows are less vulnerable to attack. In terms of vulnerabilities across the industry, Evans says only about 5% are in Microsoft software. This has led to a shift in emphasis to targeting third party programs and utilities. In XP, around 45% of attacks exploited third party (ie non-Microsoft) code, whereas with Vista and Windows 7 it's around 75%.

This means Windows Update is not enough to protect users, who must also install updates from Adobe, Apple and other software suppliers. (For Windows 7 users, Adobe Reader took three places in the top 10.)

However, Microsoft is now finding fewer infections when it scans PCs, which it does by running its Malicious Software Removal Tool before installing Windows updates. Evans says the number of "cleans" in the UK has dropped from 4.9 per thousand PCs to 4.1 per thousand.

In the UK, Win32/Renos was the top Trojan found by Microsoft security products, with 245,921 infections, and the Win32/Hotbar adware came second with 228,801 infections. The much-publicised Conficker worm placed 13th with 57,133.

Fake security software continues to be a major problem. Win32/Renos claims that your PC is infected with spyware and offers to remove it for a fee. Win32/FakeXPA, Win32/Yektel, Win32/Winwebsec, Win32/FakeSpypro, Win32/FakeVimes, Win32/FakeRean and Win32/InternetAntivirus all appeared in the top 25.

But game password stealer Win32/Taterf -- the world's most common bit of malware, as detected by Microsoft -- only ranked 24th in the UK.

As usual, most threats exploit vulnerabilities that have been fixed. For example, 75.8% of the attacks on Microsoft Office files exploited a single vulnerability (CVE-2006-2492, the Malformed Object Pointer Vulnerability in Microsoft Office Word), and you can see when that was found: 2006.

If you've been caught by a vulnerability when you've had more than three years to apply a free fix, whose responsibility is that?

Today's best video