Microsoft dismisses zero-day threats

Powered by SC Magazine
 

Conventional problems are more worthy of your time.

Microsoft has played down the danger posed by zero-day bugs, claiming that only a tiny proportion of malicious exploits target unpatched vulnerabilities.

In its latest Security Intelligence Report, the company said only 1 percent of exploits targeted newly discovered threats, meaning that administrators should focus on social-engineering scams and keeping software up to date to avoid as many threats as possible, rather than stress over zero-days.

"Consider this information when prioritising security practices," said Vinny Gullotto, general manager at the Microsoft Malware Protection Center.

"The Security Intelligence Report provides techniques and guidance to mitigate common infection vectors, and its data helps remind us that we can't forget about the basics. Techniques such as exploiting old vulnerabilities, Win32/Autorun abuse, password cracking and social engineering remain lucrative approaches for criminals."

The company said 90 percent of infections that were attributed to vulnerability exploitation had been addressed by a security update available from the software vendor for more than a year.

According to Microsoft, end-user weaknesses - typically falling for social-engineering techniques - were to blame for almost half of all malware propagation in the first half of the year, while more than a third of all malware was spread through cybercriminal abuse of Win32/Autorun.

Microsoft was also quick to point the finger at other software manufacturers, highlighting findings that showed “the most commonly observed type of exploits in the first half of the year were those targeting vulnerabilities in the Oracle Java Runtime Environment, Java Virtual Machine, and Java SE in the Java Development Kit2".

Microsoft said Java exploits were responsible for between a third and half of all exploits observed in the past year, although the report did admit that exploits targeting the Windows vulnerability CVE-2010-2568 had seen operating system exploits rise sharply in Q2 this year.

Copyright © Alphr, Dennis Publishing


Microsoft dismisses zero-day threats
 
 
 
Top Stories
NICTA no more as CSIRO takes over
Data61 split out under executive.
 
Inside the stalemate on Australia's piracy code
Still not registered almost five months on.
 
IT staff outline deep anger in Macquarie Uni survey
‘Morale at lowest point in a decade’.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Say goodbye to OneDrive Groups
Aug 28, 2015
If you've a) actually been using OneDrive and b) gone so far as to actually have been using ...
Libreoffice 5 review
Aug 24, 2015
It's free! It's open! But does LibreOffice deliver on its promise of a powerful office suite for ...
How to disable Cortana in Windows 10
Aug 21, 2015
Stop Microsoft's personal assistant snooping around.
Uni is optional: 5 tech leaders without a degree
Aug 17, 2015
Already running a business, but thinking about going back to uni? From Bill Gates to Steve Jobs, ...
New features coming to Xero
Aug 17, 2015
Use Xero? Here are some of the things you can look forward to in the coming months.
Latest Comments
Polls
New Windows 10 users, are you upgrading from...




   |   View results
Windows 8
  46%
 
Windows 7
  45%
 
Windows XP
  4%
 
Another operating system
  3%
 
Windows Vista
  2%
TOTAL VOTES: 749

Vote