Zero-day bugs overrated, Microsoft says

[win7holic]

Exploits of unpatched vulnerabilities account for about one-tenth of one percent of all attack activity

That's Microsoft advice when news breaks about the latest zero-day vulnerability, a flaw that hackers exploit before a software developer manages to patch the problem.

"We're not saying don't worry about zero-days. But they need to be put into context," said Jeff Jones, a director of security with Microsoft's Trustworthy Computing group. "For the person who has security as a day-to-day job, they need to worry about the things that are most prevalent and most severe."

read more

 

[Hungry Man]

For someone on a forum like this who protects themselves 0day exploits are kinda the wrench in their system. For the average user maybe not so much.

I believe with malicious files you have to worry more about 0days but most exploits we see in the wild are from unpatched systems.

 

[Jack]

Social engineering is much more dangerous than exploits ..... Finding vulnerabilities in software or in the operating system is hard job and it requires a certain level of knowledge. Like Microsoft I do agree that the risk is overblown

This is a great video which resonates with my opinion :

 

[bogdan]

I'm probably able to stay away from social engineering but there is little I can do about a 0-day bug that is actively being exploited. I'm also selfish so I would like Microsoft to release a patch as soon as possible. On the other hand, I understand that it is impossible to build a bug-free OS, especially a complex one as Windows.

 

[Hungry Man]

Interesting how Google has a study showing completely different results.

 

[Jack]

[attachment=855]
Malware detected by the Microsoft Windows Malicious Software Removal Tool (MSRT) in the first half of 2011, categorized by propagation methods.

Surprised to see that Zero day exploits have 0% , I was expecting to see at least a 0,2% but I guess that wouldn't make Microsoft look good.
Anyway the report confirms that socially engineered malware (scareware pop ups; blackhat search engine optimization attacks), or malware requiring user interaction such as campaigns enticing users into downloading and executing a malicious file are the main source of infection.

Read : Microsoft Security Intelligence Report Volume 11.

 

[Hungry Man]

And yet Google puts exploits outnumbering socially engineered malware nearly 100:1.

I can't believe it's 0.0%. Literally makes 0 sense.
http://www.zdnet.com/blog/security/adobe-flash-zero-day-exploit-in-the-wild/1189
http://www.adobe.com/support/security/advisories/apsa11-01.html

We've seen these before.

How many articles have we seen seen showing Java exploits as attack vectors? Or Flash? Or even Windows? They may not always be 0days but they're still exploits.

Known exploits make up for only 5.6% of the malware according to this study. It's just so strange that Google's report contradicts it so wildly.