Net criminals shun virus attacks
481118
Hi-tech criminals are turning away from viruses to mount the most serious attacks, warn security experts.
200272
Security pros have their say Anti-Virus vendorsâ¦
316177
An attack combining malicious codes on Web sites and end-user laziness could compromise millions of routers still configured with their out-of-the-box defaults.
684924
Spyware is rife and virus infection commonplace yet many home users reckon they are safe from online threats. An AOL/National Cyber Security Alliance (NCSA) Online Safety Study - conducted by technical experts
189361
Program isn't entirely benevolent: it also downloads files to infected PCs.
503421
(InfoWorld) - Malware-infected botnet PCs have overtaken denial-of-service attacks as the top security issue facing Internet service providers and other Web infrastructure hosting players, according to a new survey of the organizations. Arbor Networks published the results of its third-annual Infrastructure Security Report on Monday -- a survey of 75 large ISPs, hosting companies, and other providers -- which found for the first time that botnets currently outrank DoS threats as the most serious concern for the firms. Tens of millions of PCs are likely infected with botnet programs worldwide, according to survey results, and Arbor researchers said the ISPs they questioned admitted to spending more time and resources battling botnets than ever before. Infrastructure providers are finding botnets hard to pin down, as the people responsible for controlling the zombie machines are increasingly employing more advanced detection evasion techniques, said Craig Labovitz, chief scientist at Arbor. As they can't accurately gauge the size of the problem, he said, infrastructure providers are afraid they're only scraping the tip of the iceberg in taking on the botnet phenomenon. "ISPs are spending a lot of time trying to measure, and there's a lot of subjective data, but there are such widely different qualities to the various bots that it's a real challenge to get any strong metrics," Labovitz said. "We are seeing a widening separation between the pros and the amateurs, but as easy as it is to infiltrate and measure the less sophisticated botnets, the pro grade stuff is far more problematic and harder to trace." By using the same peer-to-peer botnet propagation strategy that has made the so-called Storm worm a recurring problem in terms of generating subsequent infections, the sophisticated sect of the botnet community is moving forward at a rapid pace, according to Arbor. In eliminating the need for traditional botnet command and control centers using P2P techniques to distribute the threats, the attackers have also removed the most efficient place to attempt to take down the attacks, the researcher said. At the same time, denial-of-service (DoS) attacks -- which have long-ranked as the primary concern of ISPs and their brethren -- have not disappeared, but rather become more targeted and efficient in the application of their resources, making them even more damaging to their individual targets, according to the report. Labowitz said that while a traditional distributed DoS threats have measured at under 10GB, newer DoS attacks are reaching as high as 24GB -- enough to completely shut down a smaller ISP or Web server farm. As the attacks are getting more powerful, they are also being concentrated on smaller groups of individual targets, or groups of sites, versus being unleashed to the Internet at large. In one such situation just last week, Labowitz said, an unnamed gambling site was taken offline for a number of hours. "For the most part, if you read the press you don't hear about DoS as much, so people jump to the conclusion that it's not happening. But it's still out there," said the researcher. "The attacks may only be targeted at a small group of sites, but that can also help to increase the significance of the impact to the provider involved based on the more narrow focus." Despite the lingering threat of DoS, ISPs have become better equipped at warding off the attacks and protecting their customers, and often times have begun charging for premium services to address the issue, according to Arbor. As opposed to five years ago, when infrastructure players often had to scramble to respond to DoS campaigns as they emerged, Labowitz said most sizeable companies now have appropriate procedures and equipment to at least partially deflect the assaults. "Even though 90 percent of the attacks are a soft threat at this point, some of those remaining attacks are bigger than anyone can handle easily -- even some of the big guys," said Labowitz. Arbor predicts attacks on Internet telephony services will represent one of the next immediate pain points for infrastructure players. Only 20 percent of the companies surveyed for the report said they had any gear in place to detect VoIP threats. Only 11 percent reported that they had any plans or tools in place to mitigate VoIP-based attacks. "We haven't seen many of these threats yet, but we know the proof-of-concepts are out there," said Labowitz. "With the amount of VoIP infrastructure that is being deployed, the ISPs and telephony providers will need to ensure that they have something in place to protect those networks from attack."
267647
The Banker-AJ trojan has been coded to lie dormant in the background on infected Windows PCs. When users visit legitimate online banking Web sites of certain UK banks, the malicious code is
330782
Troublesome Trojan horses, virulent worms, nasty viruses--sometimes it may seem like the Internet exists just to let the bad guys attack your PC.
242872
Apparently, some two thirds of home users think they are safe from online threats, but 20 percent of home computers are infected by a virus, and 80 percent have problems with spyware and adware.
505355
Fending off predators, preteens and malware perpetrators on the most-visited Web site in the nation? Meet the guy who's got the job you're glad you don't have.
259444
A new computer virus is catching people out by coming back from the dead.
654308
Some years ago, I got a job doing network support for the District Attorneyâs office in a large city that shall remain nameless. When I arrived, the network was a mess! Malware was rampant, Internet and WAN connections were saturated, and users were constantly complaining about slow computers and network performance. Even so, my attempts to enforce a mindful security policy were met with fierce resistance. The attitude among the legal staff was, âThis is my computer and my network; youâre just a computer janitor.â
634401
Antivirus companies urge e-mail caution as new variants of worm hit the Net.
755872
(InfoWorld) - During the past two years, security experts and software vendors have downplayed the threat of so-called worm viruses, but new evidence suggests that the attacks are still as dangerous, if not more so, than ever. While the enormous mass-mailing worm viruses of years past -- such as the well-known MyDoom, Sobig, and Slammer attacks -- that were aimed at crippling IT infrastructure have all but disappeared, smaller outbreaks that aim to load financially-motivated malware onto end users' computers -- such as the recent Storm Worm -- will continue to menace the Internet, according to researchers. Consensus opinion among security experts has been that as businesses and consumers improved their desktop security tools and computing habits, it became harder for malware writers to lure the same volumes of people with worms. This trend pushed the attackers away from creation of the self-propagating threats and further into financially-motivated crimeware, market watchers observed. However, the continued spread and modification of Storm Worm, which first surfaced in mid-Jan. 2007, could illustrate an emerging breed of the attacks that is likely to trouble users in years to come. On Feb. 27, workers at security software maker Secure Computing released details of a newly-emerging variant of Storm Worm that adds a Web-based social engineering component to the attack's more traditional e-mail and IM delivery models. According to San Jose-based Secure, the new version of Storm Worm sits on an infected computer and waits for a user to post a message to a Webmail system or online bulletin board site, and then adds a link to those communications that sends anyone who clicks on the URL to a malware-laden Web page. Threats that sit on the Storm-generated sites include variants of the attack itself, along with a range of crimeware programs aimed to steal sensitive personal or financial information. Viruses like Storm, which can also be classified as a Trojan rootkit, reflect the manner in which attackers will leverage the time-honored worm platform to pass along their latest work, said Dmitri Alperovitch, principal research scientist at Secure. "We're not discounting the threat from targeted financial attacks, but those tend to take a lot of work to pull off, as the attacker must do recon on the organization or user and put a good deal of effort into each target," Alperovitch said. "The payback on those attacks is probably greater, but these types of worms like the new variants of Storm can pay for themselves pretty quickly; there's little doubt we'll see more designed in this manner." In addition to using the worm approach to distribute cutting-edge malware, the Storm variations have adopted a number of other characteristics typically associated with newer attacks. The threat code itself is being changed at a rapid pace to avoid detection by antivirus systems, according to the Secure researcher, and is using an ever-changing list of URLs and IP addresses to deliver its payload and fly under the radar. The swiftly-changing profile of Storm Worm will make it hard for traditional security products to keep up with such threats, he said. "With this added technique of constant morphing and many new variants, I can't imagine how signature-based based technologies will ever cope with this sort of thing -- people truly need behavior-based tools to stop them," said Alperovitch. "We haven't seen the mass mailing, mass targeting worms that were big in the past, and Storm is not mass targeting compared to some of those, but the Web component will allow it to propagate much faster, so we'll have to keep a close eye on it." Anti-virus software makers agreed that traditional signature-based tools alone will not suffice to stop the new breed of worm, but they said that the attacks can be thwarted using a combination of those products and newer behavior-based systems. Officials at AV market leader Symantec, based in Cupertino, Calif., said that they view Storm as more of a Trojan than a worm, based on the fact that its spread is relying on social engineering methods versus automated propagation. Either way, users should rely on a defense-in-depth security strategy to protect themselves from either form of attack, according to Dave Cole, director of Symantec's Security Response team. "The major threat of today isn't the worm of yesteryear, but really the Trojan attack as the designers are using really sophisticated social engineering to trick people into downloading," Cole said. "The classical worms are still out there, we still see a ton, but the reality is they are not infecting nearly as many people because of the defenses out there; these new ones are a bigger threat." While behavior-based tools such as IDSes may represent the most effective form of defense against the rapidly-changing worm threats of today, users should still employ signature-based anti-virus applications to protect against anything that sneaks through those filters, according to the Symantec researcher. Dan Hubbard, vice president of security research at San Diego-based Websense, said that much as with every other breed of malware, worms will be increasingly laced together with different types of attacks to help increase their reach and destruction. He said worms won't likely become the leading virus format again anytime soon, according to the expert, but they will remain on malware artists' palettes as yet another option when they are creating their latest work. "At a macro level, e-mail only worms have become less frequent, but their use in combination with other attacks is getting more sophisticated and will likely continue to appear," Hubbard said. "Automation will be used to deliver new variants even faster than ever, and they will be self-updating and self-modifying; this is part of the overall increase we're seeing in the variety of ways that people are being infected over the Web."
383611
It&#39;s not just good cheer that spreads during the festive season. Also extending their tentacles are a plethora of computer viruses even as e-greeting cards sly about cyberspace.
538021
Antivirus vendors report the threat to users is minimal now that the code is offline.
236050
'Virtual security solution' is designed to slow virus and malware attacks.