Attacks/Breaches
8/12/2010
02:04 PM
50%
50%

Symantec Finds 92% Of All E-Mail Is Spam

Report also says phishing is down despite the rise of a new Live-Chat based attack that tries to trick people into giving up personal details.

Spam is on the rise, and as of July 2010 comprises 92% of all e-mail messages, up from 89% just one year ago, according to a new Symantec study of spam and phishing trends.

Alarmingly, Symantec has also discovered a new type of attack that spoofs an e-commerce website's "live chat" feature that targets a person's login ID and password for the legitimate e-commerce site. "The phishing site involved bogus chat sessions to help the page look more authentic, trying to give customers the impression that the phishing website was interactive," said Symantec.

On the good news front, however, the amount of spam containing a phishing attack declined from June to July of this year by 5%.

Likewise, the number of different kinds of phishing attacks overall has been declining. In particular, the number of unique phishing websites -- created by automatic attack toolkits -- decreased by 60% from June to July, though the number of unique URLs used in phishing attacks increased by 10%.

In addition, non-English phishing sites -- especially in French and Italian -- have been continuing to grow, increasing by 15% from June to July of this year.

Spammers, ever topical, also continue to shift their tactics. A year ago, Barack Obama and Michael Jackson led the spam subject-line charts, while this past June the World Cup dominated. In July 2010, however, the most-seen spam subject line was "claim your part of the $20 billion BP oil fund."

Regional variations, however, are in full effect. Cruelly, Russian spammers are blanketing their country -- in the grip of a combined heat wave and wildfires of unknown magnitude -- with false advertisements for air conditioners.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0235
Published: 2015-01-28
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVE-2015-1375
Published: 2015-01-28
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.

CVE-2015-1376
Published: 2015-01-28
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.

CVE-2015-1419
Published: 2015-01-28
Unspecified vulnerability in vsftp 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.

CVE-2014-5211
Published: 2015-01-27
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.