Windows 10: Evolving Microsoft SmartScreen to protect you from drive-by attacks

Brink · Dec 15, 2015

Microsoft SmartScreen, integrated with Microsoft Edge, Internet Explorer, and the Windows operating system, has helped protect users from socially engineered attacks such as phishing and malware downloads since its initial release in Internet Explorer 7. With URL reputation checks and Application Reputation protection, SmartScreen has protected users from billions of web-based attacks in the last 8 years. Over time, SmartScreen has expanded its scope from phishing attacks and socially engineered malware to also include warnings for deceptive advertisements and support scam sites.

Today, we’re happy to announce that with the latest Windows 10 updates, we’ve extended SmartScreen to include protection from drive-by attacks in Microsoft Edge and Internet Explorer 11.

What is a drive-by attack?

Drive-by attacks are malicious web attacks that tend to start on trusted websites, targeting security vulnerabilities in commonly used software. What’s more, they often don’t require any user interaction – so there’s nothing to click, nothing to download – and infection is usually invisible.

Drive-by attacks make use of services known as exploit kits (EKs) to scale effectively. These are tools that first check your PC for software vulnerabilities (tracked publicly as CVEs) and then try to exploit them. The vulnerabilities can be either newly discovered ones – also known as 0-days – or ones that have already been fixed in popular software. Over the past year, we’ve seen EKs moving faster to target vulnerabilities in apps with available patches, while also exploiting 0-day vulnerabilities more frequently as well.

Given this trend, users have less time to update to a secure state and can no longer rely on staying patched as a reliable EK defense. Fortunately, Microsoft has cultivated a broad set of data from sources like Microsoft Edge, Internet Explorer, Bing, Defender and the Enhanced Mitigation Experience Toolkit (EMET) to be able to see these attacks as they emerge, and to turn this information into the intelligence that powers SmartScreen drive-by protection in the browser.

This cross-company data intelligence effort is unique since it brings together information not just about the browsing experience or web infrastructure, but also about behavioral telemetry from across the Windows operating system. This can help us to detect potential attacks in progress and detect emerging threats.
To illustrate how this works, let’s look at a specific case study. Last December, as part of the development of this new SmartScreen capability, multiple Microsoft data sources including Defender and EMET picked up a new set of exploit attacks targeting millions of users through a network of malicious ads displayed on popular sites. The threat, broadly referred to as the HanJuan EK, was detected by SmartScreen’s exploit intelligence systems. As we dug into the data, we discovered the attack was actually leveraging a new 0-day exploit in Adobe Flash player, meaning that SmartScreen intelligence systems were detecting this attack even before it was identified as a new 0-day exploit. We reported the issue privately to Adobe (CVE-2015-0313) and a patch was developed and shipped.
With SmartScreen drive-by protection, these types of threats may be prevented before a user is infected, even if a patch isn’t yet available.

How has SmartScreen evolved to help me?

Unlike existing SmartScreen protection from socially engineered attacks, drive-by attacks need to be detected and prevented before any web content is parsed and rendered. To avoid impacting browsing performance, SmartScreen helps protect against drive-by attacks by using a small cache file created by the SmartScreen service. This cache file is periodically updated by your browser to help keep you protected and to ensure that calls to the SmartScreen service are only made if we believe there’s a high probability of malicious content on a page.

If SmartScreen determines that a website is potentially malicious, you’ll see a red warning and the content won’t render in either Microsoft Edge or Internet Explorer 11 on Windows 10.

Microsoft SmartScreen warning

SmartScreen also has the ability to warn you about potentially malicious frames, such as unsafe ads. In the past, unsafe frames on a page would result in a full-page warning, even if the webpage hosting the content was safe. Now, SmartScreen can show you warnings for only the frames that are found to be malicious, letting you continue to interact with the rest of the page.

Microsoft SmartScreen frame warning

You can expand the More Information link on the SmartScreen warning page to report a site as safe to Microsoft or to bypass the warning – though we highly recommend that you don’t bypass it. For warnings shown in frames, you can click the Unsafe Content badge in the address bar for the same options
Note: All existing SmartScreen settings and controls (including Group Policy) apply to SmartScreen’s new drive-by attack protection.
Is there anything else I can do?

When drive-by attacks target vulnerabilities that have already been fixed in popular software, your browser, or your operating system, it’s vital that you install security updates when they become available.

Additionally, if you find a site that you think is unsafe, you can report it to Microsoft using:

Microsoft Edge on Windows 10. Tap or click the More menu, choose Send feedback, and then choose Report unsafe website.

Internet Explorer 11 on Windows 10. Tap or click the Tools button

, point to Safety, and then choose Report unsafe website.

We’re excited about these improvements and look forward to hearing your feedback! If you have any questions, please don’t hesitate to reach out to us @MSEdgeDev on Twitter or in the comments below.

– Jasika Bawa, Program Manager, OS Security
– Ryan Colvin, Senior Program Manager, SmartScreen
Click to expand...

Source: Evolving Microsoft SmartScreen to protect you from drive-by attacks | Microsoft Edge Dev Blog

:)

Amit(Kumar) · Dec 15, 2015

Windows 10 online upgrade/Problems with Edge

Hello Doug,

Thank you for posting your query in Microsoft Community.

We do understand your concern and we will be happy to help you regarding this.

You may disable "SmartScreen Filter" and check if it helps. Please follow these steps:

a. Open Microsoft Edge.

b. Click "More Actions" button on the top right corner and then click
settings.

c. Drag the mouse cursor to turn off "Help protect my PC from Malicious sites and downloads with SmartScreen Filter".

Note: Your computer may become vulnerable to malware attacks or browser hijacking if you turn off "SmartScreen Filter".

I hope this helps you. If you have any further queries, feel free to contact us. We will be happy to help you.

Thank you.

Martmcd · Dec 15, 2015

How to ensure key applications will still run after Win10 upgrade

I am glad you experienced no problems, I suspect that your backups (like mine) will be collecting dust for some time.

I am really not a fan of Norton, has so often been outperformed by free antivirus software, its a resource hog, tries to take too much control of the pc, causes as many issues as a virus and has a history of being very slow to deal with new threats.

A new thread may be a good idea, to get a range of views so that you can make an informed decision, my view is biased against Norton.

from
https://blogs.windows.com/msedgedev/2015/12/16/smartscreen-drive-by-improvements/

If SmartScreen determines that a website is potentially malicious, you’ll see a red warning and the content won’t render in either Microsoft Edge or Internet Explorer 11 on Windows 10.

Microsoft SmartScreen warning

defender has been improved with windows 10, but the following (refers to windows 8) may give some insight as well.

from

http://windows.microsoft.com/en-US/windows-8/windows-defender?woldogcb=0

SmartScreen Filter in Internet Explorer helps protect users from phishing and malware attacks by warning you if a website or download location has been reported as unsafe.

You'll see a warning like this if you browse to an unsafe website

Windows 10: Evolving Microsoft SmartScreen to protect you from drive-by attacks

Evolving Microsoft SmartScreen to protect you from drive-by attacks

Evolving Microsoft SmartScreen to protect you from drive-by attacks

Evolving Microsoft SmartScreen to protect you from drive-by attacks - Similar Threads - Evolving Microsoft SmartScreen

LSA protection and attack surface rules

exploit protection settings and smartscreen off

exploit protection settings and smartscreen off

exploit protection settings and smartscreen off

Ark survival evolved from the microsoft store

Protect Shadow Copy From Ransomeware Attack in Windows

Smartscreen. Smartscreen. Smartscreen.

System Center Endpoint Protection protection network attacks

Protect PC from High-End Attacks?