The Hindu Business Line : ‘Majority of malicious Web sites legitimate’

Coimbatore, Jan. 24 A Websense research report released here has revealed that a majority of malicious Web sites were now legitimate sites compromised by attackers.

‘For the first time – the number of legitimate Web sites compromised by attackers has surpassed those purposefully created by attackers,’ the report said.

Websense researchers have warned Internet users to be wary of what sites they click on and visit, including their favourite trusted sites. “These sites could pose significant business risk because traditional security measures are not designed to handle the attacks and the attackers use sophisticated techniques such as spoofing search engine results to drive traffic to infected sites. Attackers know that compromising sites with generally good reputation, such as sites that have a built-in group of visitors – coupled with more effective and targeted e-mail lures, can increase the success rate of attacks.”

“Attackers are compromising legitimate Web sites to infect visitors with information-stealing code or add users’ machines to botnets,” the Vice-President of Security Research, Websense, Mr Dan Hubbard, has said. Attackers would continue to be creative and leverage Web 2.0 applications and user-generated content to create bigger security concerns for organisations, the report said.

“Organiations would, therefore, need to ensure their Web, messaging and data security solutions protect the avenues hackers seek to exploit for financial gain,” the report said.

The findings reveal that event-based and Web 2.0 attacks were on the rise in the second half of 2007. Blended threats with multiple attack vectors evaded traditional signature-based security technologies, such as anti-virus.

Highlights from the Security Trends Report for the second half of 2007 showed that attackers tried to perfect the blended threat technique by using multiple attack vectors to evade detection and increase attack effectiveness. In addition to compromising legitimate Web sites, the attackers increasingly used spam to lure users to malicious Web sites. “Nearly 65 per cent of all unwanted e-mails contained a link to a malicious Web site,” the release said.