70 Of Top 100 Web Sites Spread Malware70 Of Top 100 Web Sites Spread Malware
Advice to visit only legitimate Web sites appears to be meaningless as increasing numbers of mainstream sites contain known malicious code.
January 21, 2009
Internet users are often encouraged to visit only legitimate Web sites to reduce the risk of malware infections, but distinguishing between legitimate and illegitimate Web sites increasingly appears to be meaningless.
Seventy percent of the top 100 Web sites either hosted malicious content or contained a link designed to redirect site visitors to a malicious Web site during the second half of 2008, claims Websense's report State of Internet Security, Q3-Q4, 2008.
That represents a 16% increase over the first half of 2008.
Perhaps more to the point, Websense says that 77% of Web sites with known malicious code are "legitimate" sites, calling into question the utility of any such designation of approval.
There are a variety of ways that brand-name sites can be compromised, including online iFrame injection services that rely on stolen logon information or SQL injection attacks.
Spam messages with malicious links can also lead to site compromises. According to Websense's report, almost 85% of e-mail messages were spam during the second half of 2008, and more than 90% of spam messages contained links to spam sites or malicious sites.
Only 6% of spam messages were phishing attempts, a 33% decrease from the first six months of 2008. Malware authors appear to be focusing more on data-stealing Trojans and DNS poisoning to accomplish their goals.
Porn-related spam surged 94% during the latter half of last year, a marketing gambit that appears to be consistent with porn industry poor-mouthing -- earlier this month, porn moguls made a show of stated plans to ask the U.S. government for a $5 billion financial bailout to shore up sagging sales. Porn spam, however, only represents 9% of the spam out there.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks