ie8 fix
madison

Networking

Steven J. Vaughan-Nichols

One in fourteen Internet downloads is Windows malware

By | May 18, 2011, 12:12pm PDT

Summary: Microsoft admits that one in fourteen downloads are Windows malware. And you thought the Mac having malware trouble was news!

Yes. It’s true. For the first time, Mac users have a significant malware problem. But, hey, it could be worse. You could be running Windows. After all, Microsoft, not some third-party anti-virus company trying to drum up business, has just admitted that based on analysis gained from IE 9 use, “1 out of every 14 programs downloaded is later confirmed as malware.

If I may quote from Matthew 7:5, the King James Bible, “First cast out the beam out of thine own eye; and then shalt thou see clearly to cast out the mote out of thy brother’s eye.”

Window PCs has far, far more malware trouble than Macs, and I can’t resist mentioning that after in twenty-years of Linux, we’ve not seen a real-world example of Linux malware–not counting the Android malware mess. Ironically, these latest appalling Windows malware numbers are shared in a Microsoft blog about how well SmartScreen Application Reputation is working in IE9.

While it’s true that SmartScreen in IE9 is doing excellent work in protecting Windows users form Internet-borne malware, it leads to other questions. The biggest, to my mind, is that, since Microsoft proudly boasts that IE9’s new “Application Reputation will prevent more than 20 Million additional infections per month (on top of existing SmartScreen URL reputation blocks),” why doesn’t Microsoft offer IE9 to its XP users?

I mean Microsoft just said that there’s an incredible amount of Windows malware out there on the Internet. Seriously Microsoft, instead of spending money of ads trying to con… convince people to shell out hard earned cash for new Windows PCs, why not port IE9 to XP. According to the April 2011 average of the various sites that measures client operating systems on the Web, Windows XP has 39.11% of the market while Windows 7 only has 28.5%. Would it really be that much trouble-any trouble?–to deliver better Internet security to the majority of your customers?

In the meantime, no matter what operating system you run, and yes that includes Macs and Linux, you need to take anti-virus software and malicious Web sites seriously. Android users, for example, can’t get 99.9999% of the malware out there, but their Google application sessions can still be spied on and if you’re not securing your network sessions, it doesn’t matter what you’re running, your Web sessions can still be hi-jacked with Firesheep.

Sure, Windows, with or without IE9 has more security problems than all the other operating systems rolled together, but today network insecurity is everyone’s problem.

Related Stories:

An AppleCare support rep talks: Mac malware is “getting worse”

What a Mac malware attack looks like

Android has a gaping network security hole

AT&T readies security service to counter the mobile virus threat

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system

Disclosure

Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols is a freelance writer. He does not own stocks or other investments in any technology company.

Biography

Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system; 300bps was a fast Internet connection; WordStar was the state of the art word processor; and we liked it.

His work has been published in everything from highly technical publications (IEEE Computer, ACM NetWorker, Byte) to business publications (eWEEK, InformationWeek, ZDNet) to popular technology (Computer Shopper, PC Magazine, PC World) to the mainstream press (Washington Post, San Francisco Chronicle, BusinessWeek).

202
Comments

Join the conversation!

Just In

RE: One in fourteen Internet downloads is Windows malware
FAULKNE 13th Oct
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.
0 Votes
+ -
Message has been deleted.
Dietrich T. Schmitz, ~-~ Your Linux Advocate Updated - 20th May 2011
@Steven J. Vaughan-Nichols

Hey i-Naive, get a new profile pic - you look like Steven Hawkings.

The fact of the matter is if you run windows vista/7/2008/2008R2 patched, preferably IE9 or Chrome 12, and with a firewall in front of you (actually a simple NAT device) you will have 0, that's ZERO problems, (unless you go and download and install a piece of malware, which any OS has that problem).
You will also benefit from the largest software and hardware support system world! No need to run a slow VM (or dual boot) with Windows on your Cr Apple.

Additionally, if people would start setting up their users to run as standard users and not administrators, that would certainly help if they did click and run the malware.
@mikroland Really? That's funny. I keep my Windows 7 patched FREQUENTLY, and have a firewall, and installed Windows Defender and update and run it daily.... and yet I get Malware without "going out and installing it".
@mikroland I'm running Ubuntu, Win 7, Vista and XP across 3 laptops and 4 servers (currently) and have had some 20-odd computers under my direct control over the past 20yrs and I only remember getting malware on any of my computers twice: once from a bad game download back in the late 90's and once on an XP system infected by another system on the same local network.

I'm fairly happy to suggest that user activity (porn, piracy and plebeian-ism) has a MUCH bigger impact on your system security than which OS you're running.
@mikroland ... Not bad, but ... "you will have 0, that's ZERO problems," is totally silly and untrue. There is no such thing as "never" or "0" problems!
@mikroland ... And it only attacks Windows with 4 Zero-day exploits (which is a record). Ref page 16.

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
@mikroland

"Additionally, if people would start setting up their users to run as standard users and not administrators"

That's Microsoft's design failure, they should be users who occasionally need elevated privileges.

Excuse me while I just log in as root !
@mikroland

His name is Stephen Hawking, not Steven Hawkings.
0 Votes
+ -
Stuxnet ... so what
simlawstu 19th May 2011
@Joe.Smetona

Stuxnet may be the worst malware ever created, but thats only because it can affect mechanical devices used in uranium enrichment plants and nuclear reactors. Its actual effect on the average user is so close to nothing it can effectively be ignored.

Stuxnets was aimed at air-gapped security systems (no exterior network connection) by being transported via USB stick. The biggest security exploit it used were not the 0-day exploits but the hard-coded back door into the Seimens operating systems.

Maybe windows security could be better but Stuxnet would of been completely innefective if Seimens used effecctive security measures.
0 Votes
+ -
Reply to simlawstu.
Joe.Smetona Updated - 19th May 2011
No, it's the worst because it's not believed an individual or group has the ability to do it. They believe a Government is behind it and it is the most sophisticated and complicated malware ever created. The machinery involved could have been making Taskycakes or Krispy Kreme donuts, it would not matter.

No Windows, no attack, it exits. It's the first malware to use 4 Zero-day exploits at one time. A record. Tell me, what makes Windows so special here? Like Sony, RSA, Lush Cosmetics, UK, it's Windows as the root cause.

Seimens is fine, Windows was the problem. You are so wrong on so many levels. Accusing Siemens is like trying to justify installing AV on a programmable thermostat, microwave or a front loading Maytag washer.

SCADA or PLC controllers are "suppposed" to be in a protected environment. They are typically on racks and have fold out tables where operators place notebooks and connect to the system. Their mistake was just using Windows.

The following is from the "W32.Stuxnet Dossie" (70 page .pdf analysis of Stuxnet, 4th revision, 2/2011) which is available at:

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf

"Installation
Export 15 is the first export called when the .dll file is loaded for the first time. It is responsible for checking that the threat is running on a compatible version of Windows, checking whether the computer is already infected or not, elevating the privilege of the current process to system, checking what antivirus products are installed, and what the best process to inject into is. It then injects the .dll file into the chosen process using a unique injection technique described in the Injection Technique section and calls export 16

The first task in export 15 is to check if the configuration data is up-to-date. The configuration data can be stored in two locations. Stuxnet checks which is most up-to-date and proceeds with that configuration data. Next, Stuxnet determines if it is running on a 64-bit machine or not; if the machine is 64-bit the threat exits. At this point it also checks to see what operating system it is running on. Stuxnet will only run on the following operating systems:
Win2K
WinXP
Windows 2003
Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
If it is not running on one of these operating systems it will exit.
Next, Stuxnet checks if it has Administrator rights on the computer. Stuxnet wants to run with the highest privilege possible so that it will have permission to take whatever actions it likes on the computer. If it does not have Administrator rights, it will execute one of the two zero-day escalation of privilege attacks described below.
Figure 10 - Control flow for export 15W32.Stuxnet Dossier
Page 17
Security Response
If the process already has the rights it requires it proceeds to prepare to call export 16 in the main .dll file. It calls export 16 by using the injection techniques described in the Injection Technique section.
When the process does not have Adminstrator rights on the system it will try to attain these privileges by using one of two zero-day escalation of privilege attacks. The attack vector used is based on the operating system of the compromised computer . If the operating system is Windows Vista, Windows 7, or Windows Server 2008 R2 the currently undisclosed Task Scheduler Escalation of Privilege vulnerability is exploited. If the operating system is Windows..."
masses in corporations, and a lot of consumers that want computers that just work.

Windows has WAY too man attack vectors for the enterprise and government.
@DonnieBoy

There's certainly no arguing with your point. An "OS" with no features and supporting no applications should be somewhat safer than Windows, especially when factoring in that without a network connection, it has absolutely no functionality whatsoever.
@DaveN_MVP Chrome Brick? But how will it phone home to the Google Mothership?
@DaveN_MVP
DonnieBoy thinks computers should be only for surfing web other than that there is no use, thats why he preaches about ChromeOS always.
0 Votes
+ -
@DaveN_MVP LOL -
applications. But, you also missed that Google is offering native client for C/C++ applications. It has a special code verifier and sandbox. The applications run in a tab.
native client? Where have you been?
@ DonnieBoy
I developed few of them, so I know there are offline web apps with native clients. This is available even before Google started offering. The issue here, it has been tried by Oracle and the then Sun Micro and it is the same. I hate say that they sucked a lot in performance wise. This is always true for online applications also. Nope, Web applications will never kill Native Apps, unless HTML also gives the same richness in the User experience that native apps provide, whether it is Windows, Cocoa (both iOS, and MacOSX) or X-Windows and its derivatives on Unix Clones, otherwise you would not see so many apps and stores to host them on these mobile platforms. Not everything fits for HTML scenario and not everything fits into native app.
Native Client, that allows you to run C/C++ code that is verified, and run in a sandbox to give you near native compiled C/C++ code speed.

http://en.wikipedia.org/wiki/Native_client

They are also working on Portable Native Client, that will have intermediate code that is translated into local machine code on the final device, so, one binary would run on either x86 or Arm for instance. Again, this is for C/C++ code. Much different that a virtual machine like for Java or C#.
0 Votes
+ -
Reply to DonnieBoy.
Joe.Smetona Updated - 19th May 2011
A friendly reminder about using Wikipedia links in these posts.

I found the material deleted the next day when I referenced Wikipedia information. It's better to just copy the info. and back it up and use as needed without references.
0 Votes
+ -
deleted, duplicate entry
Joe.Smetona Updated - 19th May 2011
deleted, duplicate entry
@DonnieBoy
I would like to point out that C# (.NET applications, I think you mean) are NOT run in a virtual machine, like Java is. They are compiled to an intermediate language, and then JIT compiled to native machine code at runtime.

"Portable Native Client, that will have intermediate code that is translated into local machine code on the final device"
That sounds like what is going on with .NET ...
0 Votes
+ -
@DonnieBoy

Let's see 40% of PCs still run on XP. I'm willing to bet a majority of those malware downloads come from there. On top of that 90% or more computers run on Windows. Hmmm...do the math guys. It's supply and demand. If your the #1 OS you will be targeted for malware. If you're a malware developer Apple, Linux and even Chrome are a waste of time! It's not about which OS is more secure because this stuff is written by humans so there's room for error across the board. There's always going to be an idiot that doesn't care about security and will click or install anything that pops up on the screen.
are the most vulnerable. Now, don't get too cocky and think that people only attack Windows because of the numbers. It is also extremely easy compared to other platforms. ChromeOS is built from the ground up for security.
0 Votes
+ -
@rob.sharp@...
downloads!
0 Votes
+ -
Chrome is malware
osreinstall 19th May 2011
@DonnieBoy

You just don't know it. It collects data, sends you advertising and phones home.

happy
@DonnieBoy ... Go ahead: Run chrome only for 6 months to a year and see what happens when you discover there's somethinig better to switch over to. Chrome is a locked-in user app; only losing data can ever let you get away from it.
@DonnieBoy
If you trust Google, your malware battle has already been lost!
0 Votes
+ -
Re: Chrome OS
Tony R. 20th May 2011
@DonnieBoy Google's Chrome OS is designed by Google, the biggest data vacuum cleaner ever devised by the mind of man. Would you seriously trust anything that comes from Google to safeguard your data and your privacy?
0 Votes
+ -
But, hey, it could be worse. You could be running Windows.
How is it worse when I've been running Microsoft Windows for an uncountable number of years and no malware? Given that information we'll say its better that you are running Microsoft Windows. The part I don't get is that you are trying to blame Windows for malware when Microsoft didn't create any of it. In fact they go through great strides to prevent it either by permissions or by MSE. Its much safer to run Windows than linux because with Windows you know there are applications that can tell you if you have malware and clean it up for you. Linux will not give you any indication that you have malware on your PC and will leave you vulnerable for years.
0 Votes
+ -
Message has been deleted.
Dietrich T. Schmitz, ~-~ Your Linux Advocate Updated - 20th May 2011
@LoverockDavidson

I am convinced these people WANT to download and install malware, where as any tech-savvy user (ourselves included) can avoid it with no problem. As much as I shake my head in disbelief in every malware case I come across, there is no denying it has been a great source of free beer and pizza over my lifetime. Heck, I even recall one guy recently was so happy he gave me his old PC (completely working, old P4 single-core) that he upgraded from. I don't expect to have the same gratitude from an infected apple or even linux user lol
@~doolittle~
Agree. I have 2 groups of friends in the windows environment. One group always always always gets viruses. The other group have never come crying to me to help them clean any virus because they never got them. The clean group are either tech savvy or they just don't go to dirty sites or indiscriminately download stuff for no real reason at all.

The group who cries to me every 3 weeks about a virus....they KNOW they will get a virus because I have told them over and over not to visit those sites offering free music or videos of a certain nature. But they are suckers. I keep telling them that if they are going to be retarded about their computer they mind as well switch to a mac. Somehow I think they will find a way to get infected on a mac as well. I've actually mod their set up to at least prompt them with an admin password if an EXE was executed. And STILL they acknowledge it and enter the password. I see in the logs where the firewall warned them that there is an incoming virus and they still acknowledge it and allow it. Some users are just hopeless no matter what you tell them.
@LoverockDavidson I've been running Windows for years and every so often I get told of malware - sometimes on a web page, sometimes in an email, sometimes on a disk. That's life. At least in Windows I have the tools to stop these things in their tracks
@HugoM
I have plenty to stop malware in its tracks on Linux. For starters, it won't run.
Next, any app installs through the package manager. Using Ubuntu, the app gives a description of itself in the software center prior to installing and there's even a handy little feature with user reviews of the software.
0 Votes
+ -
Bad idea to rely on this.
ye 20th May 2011
@tmsbrdrs: Next, any app installs through the package manager.

There is nothing enforcing the installation of Linux software through a package manager. You need to separate convention from requirement. A package manager is the conventional way of installating a lot of software on Linux. However it's not the required way.
@LoverockDavidson
If you think you never had any malware on any of your Windows computers, you probably never ran multiple vendors anti-virus software offerings on the same system. It is well known that any single anti-virus vendor cannot protect you against all threats.
O, and for Linux, there are various system tools and checks and even anti-virus software to make sure your system is clean.
@Johan Safari: O, and for Linux, there are various system tools and checks and even anti-virus software to make sure your system is clean.

...a similar offering on Windows?
0 Votes
+ -
@Ye

A few of the Linux anti-malware solutions are usable on Windows. Many (For instance, SE Linux) are not are not usable techniques on Windows currently.

Some, like Sand boxing have finally been implemented in Windows. However, as the recent Chrome exploit shows, sand boxes can be bypassed.

The "Chrome" exploit even bypassed Chrome, and used Adobe Flash player to go directly into Windows. Google gets blamed for Adobe and Microsoft bugs. Wow!

I guess it serves Google right for burying Flash Player in the Chrome code.

I don't really see how Windows can catch up with Linux in the security area. Linux is where the experimentation takes place. At any given time, there are 3 to 10 new security ideas being tried out in Linux. The ones that seem to work are rapidly adopted across the Linux ecosystem. This process seems to take about a year. I don't see the process ending any time soon.
@LoverockDavidson Seriously, you say some funny stuff man. "Uncountable number of years"? I'd make a LARGE bet that it's less than 30 years, and if you can't count to 30, then the general quality of your trolling suddenly makes sense.

Also, there are several good malware detection programs for Linux.

But it's all a bit moot because the majority of malware (in my 10+ years experience providing desktop support to home and office users) gets onto computers through users doing stupid things and has VERY little to do with what OS you're running.
@LoverockDavidson

There are plenty of malware and root detection kits for linux, such as Talpa. The challenge for many of these applications is the continuing moving footprint of LSM makes kernel based malware scanning and rootkit difficult to get to market quickly enough.

But you are correct, it is naive to suggest that the Operating System is the main determinant in the effectivness of malware detection. In most cases nowadays, it is user behavior and user education. Spear phishing is a growth industry. The IT industry needs to do a better job in informing users about responsible computer usage.
0 Votes
+ -
@facebook@... The real challenge is getting that malware into the Ubuntu repository, whereas with Windows your 1D10T users can just go to freep0rnscreensavers.ru and download.
@james.vandamme

Excellent point. Although user education, more than anything else affects malware infection rates, one mujst not dismiss the possibility of official repositories being compromised.
There really is no challenge in getting malware into repositories. Here is one article that describes the gentoo repositories being compromised. http://www.zdnet.com/blog/bott/linux-infection-proves-windows-malware-monopoly-is-over-gentoo-ships-backdoor-updated/2206
0 Votes
+ -
Message has been deleted.
pgit Updated - 20th May 2011
0 Votes
+ -
@pgit

I did not delete my message, I assume someone at ZDNet did.

I can't understand why, I don't believe I have violated any terms of service. If I have I would expect to be notified.

Anyone else seeing their messages being randomly deleted?
0 Votes
+ -
@pgit: Anyone else seeing their messages being randomly deleted?

I had one deleted the other day. But it's not my post having been deleted that bothers me. It's, as you said, the random nature of the removals. I've seen many, many posts from others deleted and I cannot for the life of me figure out why. I even commented about it the other day saying people will quit posting if their posts are going to be indiscriminately removed. Why bother writing something if some moderator is going to remove it.
@LoverockDavidson
Running ClamAV, have my firewall on and the system monitor tells me every single app running.
When I was running Windows, I had to guess at what was running, unless, of course, I installed a third party app, which could come with hidden malware.
Still not doing your homework, I see.
0 Votes
+ -
What?
facebook@... 19th May 2011
@tmsbrdrs You do realize that Windows comes with systems monitors too? I guess the big takeaway here is that you are comfortable with one system, but not willing to learn more about Windows and its effective management.
@facebook@...
I'm quite familiar with the Windows system monitor. It's not very effective, easy to bypass by malware and can even be turned off by malware.
On top of that, many processes run in Windows are given the exact same name with different amounts of RAM or lower/higher CPU usage.
I'll freely admit, I'm not comfortable using Windows. I've seen too much that can happen due to the many many exploits.
@tmsbrdrs: I'll freely admit, I'm not comfortable using Windows.

...you feel qualified to speak about it? Even worse you expect trust what you say about it?
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix