Throughout 2008, Symantec observed a high number of legitimate web sites being compromised and inconspicuously repurposed to serve web attacks, unknown to the visitors of those sites. Today, malware authors are looking for wider targets and mainstream web sites provide a large base of users for malware authors to target. More significantly, they provide a set of users who are less likely to be concerned about being the victim of a malware attack because they hold the belief that if they only surf to mainstream Web Sites, they will be safe.
Few web sites are immune from being compromised and are used as a host to deliver malware to their unsuspecting visitors. During 2008, Symantec observed more than 18 million drive-by download attacks and more than 23 million misleading application attacks. These two attack types represented web attacks from 808,000 unique domains, many of which are mainstream web sites, including: news, travel, online retail, games, real estate, government and many others. This paper examines how these legitimate sites have become targets for malware authors, with reviews of some of the more popular techniques, such as malvertisements, used to compromise these sites.
| Top Web Threat Trends for 2008 |
| 1. | Drive-by downloads from mainstream web site are increasing |
| 2. | Attacks are heavily obfuscated and dynamically changing making traditional antivirus solutions ineffective |
| 3. | Attacks are targeting browser plug-ins instead of only the browser itself |
| 4. | Misleading applications infecting users are increasing |
| 5. | SQL injection attacks are being used to infect mainstream web sites |
| 6. | Malvertisements are redirecting users to malicious web sites |
| 7. | Explosive growth in unique and targeted malware samples |
The Symantec Internet Security Threat Report offers analysis and discussion of threat activity over a one-year period. It covers Internet threat activities, vulnerabilities, malicious code, phishing, spam and security risks as well as future trends. The fourteenth version of the report, released April 14, 2009, is now available.
Flash Demo: Internet Security Threat Report Volume XIV
Webcast: Internet Security Threat Report Volume XIV, April 30 2009
The following reports provide in-depth analysis on regional and government sector threat activity:
ISTR XIV – Web-Based Attacks
This podcast will cover the impact of web-based attacks, providing analysis and discussion of the data gathered by Symantec between January 1 and December 31, 2008. Listen now
ISTR XIV – Financially Motivated Malicious Code Development
This podcast will cover the financial motivation behind the malicious code development, providing analysis and discussion of the data gathered by Symantec between January 1 and December 31, 2008. Listen now
ISTR XIV – Phishing and Spam in the Economic Downturn
This podcast will cover the Phishing and Spam trends, providing analysis and discussion of the data gathered by Symantec between January 1 and December 31, 2008. Listen now
Read what Symantec’s Security Response experts are writing about the latest issue of the Internet Security Threat Report.
Download any of our past Internet Security Threat Reports.
