The Hindu Business Line : Malware authors change tack, spread virus via Web

Pune, April 3 By the end of 2008, about a million viruses and Trojans will pass. This is the finding of F Secure Corporation, which has reported that on an average, about 25,000 malware samples are received every day. It also points out that while there are more viruses being created than before, people often actually report seeing less of them.

One reason is that malware authors are once again changing their tactics of how to infect the computers. A year or two ago, most malware were spread via e-mail attachments, resulting in mass outbreaks such as Bagle, Mydoom and Warezov. Nowadays sending .EXE attachments in e-mail doesn’t work so well, as almost every organisation is filtering out such risky attachments from their e-mail traffic. The new preferred way is by drive-by downloads on the Web. These attacks often start with an e-mail spam run but the attachment in the e-mail has been replaced by a Web link, which is linked to the malicious Web site. So instead of getting infected over SMTP, infection is over HTTP.

Companies often measure their risk of getting infected by looking at the amount of stopped attachments at their e-mail gateway. Those numbers are definitely going down, but the actual risk of getting infected probably isn’t. Individuals and companies should scan their Web traffic for malware – as well as filtering their FTP traffic. “In parallel to the switch from SMTP to HTTP as a way of spreading malware, we are now also seeing more and more malicious e-mails that link to malware via FTP links.”

A common approach is to launch an e-mail spam campaign containing messages to click on a link. Messages like “There is a video of you on YouTube”, or “You have received a greeting card”, or “Thank you for your order” have been popular baits.

Another is to create many Web pages with thousands of different keywords which are indexed by Google, and then wait for people to visit these sites. So when one searches for something innocuous such as "knitting mittens" (as a random example), and click on a search result that looks just like all the others, the computer is getting infected.

The third method involves hacking into existing high profile, high traffic Web sites. They simply insert a line of java script on the front page which uses an exploit to infect the machine. Everything works and looks as normal. F Secure noted that MBR rootkit – known as Mebroot – is probably the stealthiest recent malware distributed by drive-by downloads.

More Stories on : Security

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
DenuoSource sets up second KPO centre

‘Mobile revolution to throw up challenges for media planners’

DoT allocates CDMA spectrum to Sistema

Mobile and fixed phone substitutability — Why does it matter for India?

Cabinet panel nod for IT investment regions

Panel draws attention to tax issues

IT spend by small, medium cos set to rise 22%: Study

Adobe creates applications for ‘living’ Web pages

FX Labs upbeat on PC games

World’s new bazaar for books

Less piracy, more jobs, says study

2 US Senators seek H-1B visa usage details from IT cos

MRTPC issues notice to Airtel, Vodafone & Idea Cellular

Malware authors change tack, spread virus via Web