Kurt Shintaku's Blog

The recent uproar over Advanced Persistent Threats & actual evidence seems to have resulted in some commentary in the Microsoft Security Intelligence Report’s latest issue.  It’s a good read for security folk and is always published at http://www.microsoft.com/sir.

Taken from our Press Release on the topic:
http://www.microsoft.com/en-us/news/Press/2012/Apr12/04-25SIRvApr12PR.aspx

Microsoft Corp. today released the Microsoft Security Intelligence Report volume 12 (.pdf file), which found that the Conficker worm was detected approximately 220 million times worldwide in the past two and a half years, making it one of the biggest ongoing threats to enterprises. The study also revealed the worm continues to spread because of weak or stolen passwords and vulnerabilities for which a security update exists.

According to the SIRv12, quarterly detections of the Conficker worm have increased by more than 225 percent since the beginning of 2009. In the fourth quarter of 2011 alone, Conficker was detected on 1.7 million systems worldwide. In examining the reasons behind Conficker’s prevalence in organizations, research showed that 92 percent of Conficker infections were a result of weak or stolen passwords, and 8 percent of infections exploited vulnerabilities for which a security update exists.

“Conficker is one of the biggest security problems we face, yet it is well within our power to defend against,” said Tim Rains, director of Microsoft Trustworthy Computing. “It is critically important that organizations focus on the security fundamentals to help protect against the most common threats.”

The SIRv12 also revealed that many of the threats often referred to as Advanced Persistent Threats (APTs) are no more advanced or sophisticated than other types of attacks. In most cases, these attacks leverage known vectors such as exploiting weak or stolen passwords and vulnerabilities for which security updates exist, but their success lies in the persistence and determination in trying different tactics to compromise the target. This is why Microsoft refers to these types of threats as Targeted Attacks performed by Determined Adversaries, rather than APTs.

…

Read the rest of the release at http://www.microsoft.com/en-us/news/Press/2012/Apr12/04-25SIRvApr12PR.aspx.

• To download this month’s Security Intelligence Report (volume 12) go to:
  Microsoft Security Intelligence Report volume 12 (.pdf file)
  http://go.microsoft.com/?linkid=9807245
  (Warning:  It’s long – 3.26MB file)