Tag Archives: malicious web attacks

671 Percent Increase in Malicious Web Sites

Malicious websites grew 233% in the last six months and 671% in the last year, stares Websense Security Labs. This was partly because of the spread  Gumblar, Beladen and Nine Ball attacks which aimed to compromise trusted and known Web sites.

Web 2.0 sites are the worst effected target as 95% of blog comments, chat rooms and message boards are malicious.

“The last six months have shown that malicious hackers and fraudsters go where the people are on the Web” said Websense Chief Technology Officer Dan Hubbard “and have heightened their attacks on popular Web 2.0 sites.”

The top 100 most visited Web properties, which are “Social Networking” or “Search” sites states Websense.

77% of sites with malicious code are legitimate sites have been compromised by fraudsters exploiting the inherent trust in a business.

61 percent of the top 100 sites either hosted malicious content or contained a masked redirect to lure unsuspecting victims to malicious sites.

The term ”malicious” typically refers to links that have specific, hidden exploits that target a user’s computer.

The next million most visited sites are primarily current event and news sites and are more regionaland genre-focused.

37 percent of malicious Web attacks included data-stealing code, 57 percent of data-stealing attacks are conducted over the web in the first half of 2009.

85.6% of all unwanted emails contained links to spam and/or malicious Web sites and 57% of data-stealing attacks are conducted over the Web. In June virus infected emails rose 600% over May.

An analysis of Web, email and data security trends during the first half of 2009 are explored in the Websense Security Labs bi-annual “State of Internet Security” report.

Daily Websense® Security Labs™ Websense ThreatSeeker™ Network parses more than one billion pieces

of content and over 40 million websites hourly for malicious code and ten million emails. The Websense ThreatSeeker Network uses more than 50 million real-time data collecting systems.

YouTube and BlogSpot are 65 percent to 75 percent ineffective in protecting Web users from objectionable content and security risks. Hate or militant content on Facebook and other popular Web 2.0 sites like YouTube, Yahoo! Groups and Google Groups.

Cyber terrorism (militancy and extremists Web sites)  increased 326 percent increase in increased 326% from January through May 2009 over the same period in 2008.

Websense tracks about15,000 hate and militancy sites, with 1,000 added in he first six months of this year.

78 percent of new Web pages discovered in the first half of 2009 with objectionable content (e.g. Sex, Adult Content, Gambling, Drugs)  and  69 percent of all Web pages with any objectionable content link served malicious content.

Sex, advertisements, business and economy, IT, and travel made up the most commonly

compromised categories of Web content. 50 percent of Web pages with a link categorized as “Sex” also have at least one malicious link.

The three most popular topics for spam remained shopping (28 percent), cosmetics (18.4 percent) and

medical (11.9 percent.)  However, over the last six months, education accounted 9.5 percent of spam.

and could be attributed to the recession.

“Spammers have been targeting the unemployed who are looking to re-train or gain qualifications to help their job prospects” states Websense.

Advertisements

Phishing Scams and your bank

phishing

“Your information security program is only as strong as your weakest link” said  Linda McGlasson of Bank Info Security.

“That weakest link is your customer or your employee sitting at a screen, deciding whether to click on that link that popped up in their instant messaging screen, or direct message box on Twitter, or visit that site that offers free ringtones (and malware as a bonus).“

Recently 10 US financial institutions in California, New York, Pennsylvania and Wisconsin receiving fraudulent text messages or automated phone calls.

On September 28, 2009, the 1st Federal Credit Union of central Pennsylvania reported that it received calls from customers about text messages claiming that their cards were blocked.

Similarly on October 2 phishers sent text messages to mobile phones in the Omaha area, claiming their bank card had been deactivated. Inclded were instructions to call an 877 number to reactivate it. At least one customer lost several hundred dollars.

“Once he changed his PIN, somebody went in and withdrew the money,” said Richard Patterson, president of Greater Omaha Federal Credit Union.

A very convincing automated phone call phishing scam directly named the Liberty Bank.

“Your card has been suspended because we believe it was accessed by a third party. Please press 1 now to be transferred to our security department” the recording, before liting an impressive array of details designed to sound official.

Customers who pressed “1” were asked to enter their credit/debit card number and personal identification number.

“There will be some losses,” Liberty Bank Vice President Jill Hitchman said. “Charges started showing up almost immediately after our customers gave away their card numbers.”

Of course, Liberty responsibly warns its customers to “never reply to email, pop-up messages or phone callers that ask for your personal or financial information. LIBERTY BANK WILL NEVER ask you to disclose your password or pin”.

Spam works because about one out of six respond to messages suspect are spam survey data by the Messaging Anti-Abuse Working Group, an anti-spam trade organization (MAAWG).

A record five million new malware threats were detected in third quarter of 2009 according to the Cloud Security firm, Panda Security. Trojans accounted for 71 percent of all new malware between July and September 2009s bots and other malware are morphing rapidly.

Globally 59% of computers are infected  states Panda.

Obviously we need to keep our viral security up to date. This is why Bank Info Security recommends regular, preferably quarterly, programs to remind their customers of secure banking practices.

The problem is that people are the weakest lin. Even normally cautious people may once in a while press a link they normally would ignore.

Since, most of us are not rocket scientists perhaps give oursleves a reality check. Perhaps we should put ourselves through a similar audit of our email and web habits.

People need to be trained to obtain a drivers license so perhaps we need to begin to train people in the rules of internet safety said Linda McGlasson.

She suggests the first very basic tips:

  • Keep your operating system up to date with the latest patches;
  • Update your anti-virus and anti-spyware regularly, if not daily;
  • Install a firewall on your PC;
  • Don’t click on links in emails that are from unknown origins (or known origins for that matter).

Malware Pandemic

A record five million new malware threats were detected in third quarter of 2009 according to the Cloud Security firm, Panda Security.
Trojans accounted for 71 percent of all new malware between July and September 2009. Adware (13 percent) and spyware (9 percent) have also all increased, while traditional viruses and worms have decreased to 2 percent of the total.

SAdly, thw weak lin is still the individual user who fails to apply basic net safety rules or applies commonsense when an impressive sounding phishing scam asks for bank details.

malware detected

PandaLabs has recorded five million new strains of malware. Most of these were banker Trojans, although adware and spyware have also increased.

“Spyware has increased for the first time this year, rising from 6.90% to 9.16%. Adware however has decreased slightly from 16.37% to 13.13%, yet it was still the second most detected malware category this year” according to the quarterly report.
“We currently receive approximately 50,000 new samples of malware every day, compared to 37,000 just a few months ago. There is no reason to believe that the situation will improve in the coming months,” explains Luis Corrons, Technical Director of PandaLabs.
There has been a marked increase in malware distributed through spam, social networks and search engine optimization techniques, which draw users to spoof Web pages where malware is downloaded. These exploit topical issues like swine flu, Independence Day, forest fires or Presidential speeches by Barack Obama.
“There is a false sense of security, as users perceive there to be no real danger at the moment. When their computers get infected, they rarely notice any symptoms” said According to Luis Corrons, Technical Director of PandaLabs, According to Panda’s U.S. computers are infected by the most dangerous malware strains: Trojans, followed by adware, worms and viruses.
The global infection rate on computers rose to 59% states Panda Security. Taiwan has the most infected PCs, with a 69.10 percent corruption, followed by Russia and China at 67.99 percent and 61.97 percent, respectively. U.S. ranks ninth with an infection ratio of 58.25. The country with the least infections is Norway at 39.60 percent.

“Spyware has increased for the first time this year, rising from 6.90% to 9.16%. Adware however has decreased slightly from 16.37% to 13.13%, yet it was still the second most detected malware category this year” according to the quarterly report.
“We currently receive approximately 50,000 new samples of malware every day, compared to 37,000 just a few months ago. There is no reason to believe that the situation will improve in the coming months,” explains Luis Corrons, Technical Director of PandaLabs.
There has been a marked increase in malware distributed through spam, social networks and search engine optimization techniques, which draw users to spoof Web pages where malware is downloaded. These exploit topical issues like swine flu, Independence Day, forest fires or Presidential speeches by Barack Obama.
“There is a false sense of security, as users perceive there to be no real danger at the moment. When their computers get infected, they rarely notice any symptoms” said According to Luis Corrons, Technical Director of PandaLabs, According to Panda’s U.S. computers are infected by the most dangerous malware strains: Trojans, followed by adware, worms and viruses.
“This is a clear sign that hackers are becoming more and more sophisticated,” said Corrons.
“Cybercriminals have found news ways to spread their creations, frequently exploiting the latest news stories to launch attacks through social networks, videos, and email. The huge amount of Trojans in circulation is due to the spectacular increase in the number of banker Trojans aimed at stealing user data.”
The global infection rate on computers rose to 59% states Panda Security.  Taiwan has the most infected PCs, with a 69.10 percent corruption, followed by Russia and China at 67.99 percent and 61.97 percent, respectively. U.S. ranks ninth with an infection ratio of 58.25. The country with the least infections is Norway at 39.60 percent.

infected PCs

The Increasing Cost of Information Security

internet_security

“In today’s complex and distributed financial services environment, an organization,from both a compliance and operational risk perspective, needs a 360-degree view of enterprise fraud investigations and loss.” wrote Michael Rasmussen of the strategy & research advisor Corporate Integrity, LLC.

Its easy for a small business owner to put this off. Security policies are full of jargon and in the mind of the business owner the more fancy it sounds, the more expensive he fears it will be.

Security software and services spending will outpace other IT spending areas in 2010, according to a survey by Gartner, Inc. Security software budgets are expected to grow by approximately 4 per cent in 2010, outpacing all other areas of infrastructure software. Security services budgets are projected to grow 2.74 per cent in 2010.

In April and May of 2009, Gartner surveyed more than 1,000 IT professionals with budget responsibility worldwide to determine their budget-planning expectations for 2010.

“In the current highly uncertain economic environment, with overall IT budgets shrinking, even the modest spending increases indicated by the survey show that security spending accounts for a higher percentage of the IT budget,” said Adam Hils, principal research analyst at Gartner.

Security-related software spending  in  2010 is likely in security information and event management (SIEM), e-mail security, URL filtering, and user provisioning.

The increased projected expense is partly driven by a growing movement towards managed security services, cloud-based e-mail/web security solutions, third-party compliance-related consulting and vulnerability audits and scans states Gartner.

32222-54

The extent of the problem is perhaps suggested by the advertising boast of RSA.com:

“120,000 phishing sites shut down.

200 million online identities protected.

Growing investment in R&D.”

Prevention is cheaper than cure and an understanding of what is required for fraud to occur can help businesses develop protective strategies.

In the 1950’s criminologist and sociologist Dr. Donald Cressey the motivation to commit fraud was mostly financial and required three factors: pressure or motivation, rationalization and opportunity.

However, the world has changed. Early hackers often wanted to prove they could do it, and even enjoy the notoriety of the achievement.

Now, revenge may be a non financial motive.

Whatever the reason, fraud requires the criminal have some form of access, some knowledge or a skillet and an Intent, or purpose or desired outcome to commit fraud.

Even if you have password access and administrator rights at work, You are probably an unlikely security risk if I can barely log on without help. On the other end of the scale, some security breaches require access to technologies available to a minute fraction of the population. While scripts of code can make other breaches possible to those with little knowledge.

“If you can reduce a user’s access/authority or increase the controls (which requires the attacker have more knowledge), then you reduce the risk” wrote Ron Woerner. “You must also ascertain what is required for the exploit.”

Ron Woerner suggests applying the following Internet Security protocols:

* Separation of duties

* Background checks, including a financial records check

* Job rotation/cross-training

* Protecting and limiting access to administrator accounts

* Role-based access control (RBAC)

It is not possible to predict all possible security threats.

“Businesses should recognise that new threats or vulnerabilities may require security spending that exceeds the amounts allocated” said principal research analyst at Gartner, Ruggero Contu “and should consider setting aside up to 15 per cent of the IT security budget to address the potential risks.”