Most malware comes from legit sites, says researcher
110548
More than half of all Web sites serving up attack code are legitimate domains that have been hacked by criminals, according to a study by Websense Inc.
172876
Domains of several new phishing sites are cropping up with known Storm worm domains. F-Secure researchers think phishers are leasing parts of the larger botnet.
532297
(InfoWorld) - Financially motivatedÂ malwareÂ attacks areÂ on the rise,Â with automated software packages making it easy for unskilled hackers to earn a living by sending out spam, researchers at messaging security vendor Secure Computing say. A malware kit calledÂ MPack,Â released by Russian hackers last December, allows pretty much anyone with $200 to become a master spammer because it is easy to use and exploits vulnerabilities in FireFox, Internet Explorer and Apple's QuickTime, says Dmitri Alperovitch, principal research scientist for Secure Computing. The trend that "kind of defines 2007" is the convergence of traditional e-mail with Web-based attacks, in which message recipients are prompted to click on links to malicious Web sites, rather than to download attachments, Alperovitch says. "Certainly, exploiting Web browser vulnerabilities has been common. We've seen that for a long time," he says. "Now we're seeing that capability being merged with traditional e-mail worms that sort of blanket the Internet." Information-stealing malware now accounts for 10 percent of all threats, up from 8 percent in January, new research from Secure Computing has found. Trojans comprise 63 percent of all newly discoveredÂ malware, up from 58 percent in January. SpywareÂ and phishing are also becoming more problematic as attackers use more targeted attacks to steal personal and financial information. "The barriers to entry into cyber crime have been lowered so much," Alperovitch says. "People are realizing that they can make very serious money with almost no accountability, almost complete anonymity." Quoting the analyst firm Gartner, Secure Computing's researchers say that 75 percent of enterprises will be infected by "undetectable professional-grade malware" by year-end. About 90 percent of all e-mail is malicious, but that figure will rise as the holiday season gets closer, according to Alperovitch. "There's a good chance we'll reach 95 percent, maybe higher, of all e-mails being malicious by the end of the year," he says. As the storm worm showed, the automation of online attacks is allowing the creation of more botnets, he says. E-mail delivery mechanisms are also being optimized to bypass spam filters. Unfortunately, many Web surfers are far too trusting. "If you're walking down the street and someone asks you for your Social Security number or your bank account pin, you're not going to give it to them," Alperovitch says. "Yet on the Internet, people freely give them out to anyone who sends them an e-mail message." Here are some key security trends and events identified by Secure Computing in the first eight months of 2007: -- TheÂ Storm worm,Â named after subject lines like "230 dead as storm batters Europe," and similar worms became widespread in January and the following months, with new variants being created every 15 minutes. -- A password-stealingÂ Trojan hit visitors to the Miami Dolphins' stadium Web siteÂ during the Super Bowl, when attackers took advantage of a vulnerability in Internet Explorer's rendering of vector markup language documents. -- A mass-email with pictures of Britney Spears and Paris Hilton in April lured people to a Web site that hosted a zero-day exploit related to Windows' handling of animated cursor files. Microsoft released a patch to fix the vulnerability. -- More than 10,000 European Web sites hosted malware attacks in June after being compromised. "Hidden IFRAME's" were injected into the Web sites, referring visitors to malicious sites using MPack to deliver banking Trojans. -- So-called backdoor Trojans affect home users around the world, including nearly 100,000 PCs now infected by a new wave of storm malware. "The mailings that came with subject lines such as 'You've received a postcard from a family member!' directed users to Web-hosted exploits for several different vulnerabilities; they infect users' computers and attach them to the Storm family's P2P botnet," Secure Computing writes. Network World is an InfoWorld affiliate.
465970
Tool kits spark explosion in malicious code base, says Symantec One weekend in June, a little-known Trojan downloader made a major debut on the international malware stage after it managed to burrow its way into more than 10,000 websites in just 72 hours. Infected sites - including one connected to rock musician Bon Jovi and another that raises money for charity work of the late Mother Teresa - suddenly became the agents of Russian crime gang, as they pushed malware on unsuspecting visitors.â¦
477742
Security researchers studying the latest Internet crime trends have discovered a new Eastern European website that uses a large botnet to infect vulnerable PCs. The operators of the botnet and website charge clients for each successful PC infection.
687090
Security researchers warned this week of a vulnerability in most Web browsers which could potentially allow scammers to launch phishing attacks from pop-up windows on trusted Web sites.
451868
The growing use of Web feed readers and the proliferation of content aggregation sites are giving hackers an easy way to deliver malware to users' computers, security analysts warn.
257738
Malware makers are increasingly using e-mail links rather than attachments to trick computer users, according to security firm MessageLabs Ltd.
114781
A computer security researcher figures out exactly how a high-tech scammer
304271
Security research, Web 2.0 style The mystery over a cluster of poisoned websites distributing a toxic malware cocktail may be better understood but it's still not solved.â¦
435599
Clean up campaign bears fruit High-profile websites have cleaned up their act after a small team of security researchers documented how they were unwittingly helping phishing fraudsters.â¦
529186
(InfoWorld) - Users of online banking sites tend to bypass critical clues that the integrity of those sites may have been compromised, according to the working draft of a study released on Sunday by researchers at Harvard University and the Massachusetts Institute of Technology. The study, which will be formally released in May at the IEEE Symposium on Security and Privacy in Oakland, California, underscores how new technologies and warnings can't completely protect Internet users fromÂ scams such as phishing. It also throws doubt on the effectiveness of site-authentication images, which have been implemented by financial institutions such as Bank of America, Vanguard Group, and ING Bank. The images, selected by the customers, are shown when a bank customer logs in from a different computer than is normally used. The study involved 67 users, with more than 90 percent under 30 years old. Because of varying parameters in the study, not all qualified to be included in the results for each of the three tests. Users were ask to conduct common online banking tasks, although precautions were taken to ensure users weren't put at risk. For the first test, HTTPS indicators -- which show that an encrypted connection is enabled -- were removed from the address bar along with the lock that appears in the bottom right corner of Internet Explorer 6. Although the absence of HTTPS indicators should be a warning, all 67 participants continued with their transactions, the study found. The researchers then conducted a test where the site-authentication image was removed along with the HTTPS indicators. The researchers wrote it is the first empirical investigation into site-authentication images. Only two of 60 people chose not to log in when the image was removed, a key sign that a site may have been tampered with or is a phishing site, the study said. Of users who were actually using their own bank account for the study, 23 of 25 continued to enter their passwords. "We find them [site-authentication images] to be ineffective," the study concludes. In the last test, researchers made it more obvious, this time replacing a password-entry page with a warning page from Internet Explorer 7 Beta 3. The page advises of a problem with the security certificate of the chosen Web site. Despite the warning, 30 of 57 users entered their passwords. The study comes as U.S. banks are beefing up their authentication technologies amid new requirements from federal regulators. In October 2005, the Federal Financial Institutions Examination Council (FFIEC) mandated that U.S. banks implement stronger authentication protections by the end of last year, particularly for high-risk transactions such as sending money to a different person's account. Bank of America uses site-authentication image technology called SiteKey. Users pick an image and assign a phrase to it while also setting three "challenge" questions. If a user logs in from a computer that doesn't already have a cookie, they're asked one of the challenge questions and then to verify the image and phrase. If the image doesn't appear or the phrase is wrong, consumers shouldn't proceed. Bank of America said the image system benefits users since it's free and doesn't involve extra hardware or software.
263846
Honeypot project shows more than adult sites contain malicious threats.
484935
InfoWorld - Researchers in the U.S. say they&#39;ve successfully shown how attackers could compromise a network designed to make it&#160;harder to trace Internet surfers&#160;and the Web sites they are viewing.
318863
Study shows most attacks come from exploited PCs beloging to DSL or cable customers.
370901
WholeSecurity's new software claims to identify fraudulent sites.
385116
The StopBadware.org effort run by Harvard law School soldiers on, and researchers report success at communicating warnings to unwary users and getting cooperation from a number of those who create or distribute such malware.