Trend Micro Global Threat Report: Europe Dominates in Spam Growth, While North America Leads in Malicious URLs

October 5, 2010 · Filed Under Security Software, Software News · Comment 

Global research network identifies threat trends during the first half of 2010, and the industries affected, along with advice for protecting consumers and businesses.

During the first half of 2010, Europe sped through the spam-generating fast-lane, bypassing North and South Americas, and Asia-Pacific to earn the “Top Producer of Spam” title. Based on the Trend Micro semi-annual 2010 threat report, spam continued to grow between January and June 2010, with a brief lull during April. Despite common perception, porn consists of only 4 percent of all spam. Commercial, scams-based and health/medical categories make up 65 percent of the spam generated throughout the world, with HTML spam being the most commonly used technique by spammers.

First half of 2010: Web-based threat trends

According to the report, malicious URLs increased from 1.5 billion in January to over 3.5 billion in June. North America sourced the most malicious URLs, while Asia-Pacific had the most victims of malware infections. The top URLs blocked by Trend Micro were adult websites, as well as sites that hosted malicious variants such as IFRAME code, TROJ_AGENT, and JS_DLOADR.ATF. Read more

Tags: , , , , , ,

Mobile Security Problems Will Drive Demand for Authentication Products

September 6, 2010 · Filed Under Security Software, Software News · Comment 

Mobile security threats are spurring the use of mobile authentication solutions to protect customer data, says Heavy Reading Mobile Networks Insider

As mobile phones become basic tools of commerce, the threat of significant theft through hacking and other illegal activities is rising, causing enterprises and network operators to scramble to find ways to protect their customers’ data through mobile authentication solutions, according to the latest report from Heavy Reading Mobile Networks Insider (www.heavyreading.com/mobile-networks).

Mobile Security: The Coming Boom in Authentication examines the issues and challenges now surrounding mobile security, focusing on security authentication as a means to safeguard mobile applications. The report identifies the key industry verticals most affected by mobile security issues, and provides in-depth analysis of the technology solutions available from eight leading suppliers of mobile authentication products, including information on deployment costs.

“There is no question that mobile security will eventually equal – if not surpass – PC security as a threat to IT departments,” notes Denise Culver, research analyst with Heavy Reading Mobile Networks Insider and author of the report. “But the reality is that enterprises and organizations should already be making moves to integrate mobile authentication as a regular business practice, as firewalls and virus scanners are utilized in the PC world today.” Read more

Tags: , , , , , , ,

Banker Trojans comprised more than 60 percent of new threats created in Q1

March 31, 2010 · Filed Under Internet Software, Security Software, Software News · Comment 

PandaLabs Q1 report shows resurgence in traditional viruses after decline in recent years

BlackHat SEO attacks using Apple and Facebook are among cybercriminals preferred strategies

Panda Security involved in takedown of Mariposa, one of the largest botnets on record

PandaLabs  has published its Q1 2010 report, analyzing the IT security events and incidents of the first three months of the year. The report can be downloaded for free at: http://www.pandasecurity.com/homeusers/security-info/tools/reports.htm.

As forecasted by PandaLabs, the amount of new malware in circulation has continued to increase at a record pace. In this first quarter, the most prevalent category was once again banker Trojans, accounting for 61 percent of all new malware. Interestingly, the second most prevalent type was traditional viruses, comprising more than 15 percent of all malware, despite having shown a dramatic decrease in recent years. A graph of the types of malware samples received by PandaLabs in Q1 is available at: http://www.flickr.com/photos/panda_security/4461973069/

“The growing prevalence of banker Trojans signals to us that online accounts for both consumers and businesses continue to be increasingly attractive financial targets for cybercriminals,” said Sean-Paul Correll, threat researcher at PandaLabs. “In addition, the widespread availability of DIY kits online has spurred new, less technical individuals into the cybercrime business as evidenced by the Mariposa case. The simultaneous growth in traditional virus activity is an interesting trend and we suspect this means that cybercriminals are attempting to draw the attention of anti-virus laboratories away from other seemingly more harmful threats.”

In other areas of IT security, botnets have seen considerable activity in 2010. For example, Panda Security played a key role in dismantling Mariposa, one of the largest botnets known to date, and subsequently detected Mariposa malware on y Vodafone devices. Mariposa stole account information for social media sites and other online e-mail services, usernames and passwords, banking credentials and credit card data through infiltrating an estimated 12.7 million compromised personal, corporate, government and university IP addresses in more than 190 countries. The botnet was shut down and rendered inactive on December 23rd, 2009, thanks to the collaborative effort of different security experts and law enforcement, including Panda Security, Defence Intelligence, the FBI and Spanish Guardia Civil.

In addition, popular online search topics, including Apple’s iPad and Facebook applications, were once again used in BlackHat SEO attacks. Similarly, cybercriminals continue to use social networks to distribute malware, a trend that saw a considerable uptick in 2009 and will continue throughout 2010.

Tags: , , , , ,

SonicWALL identifies growing threat of cybercriminals attacking new searches

March 10, 2010 · Filed Under Internet Software, Security Software, Software News · Comment 

Over 284 Top Search Terms attacked over the last 7 days with 6600 Malicious URLS; Threat team outlines tips to protect against searching threats

SonicWALL announced it identified that cybercriminals are continuing to attack Google’s top search items. In the last 7 days, more than 284 top search terms have been attacked by more than 6600 malicious URLS. The threat team has found up to nine of the top 20 search terms are under attack at any one time. To help individuals defend against these types of threats, SonicWALL’s threat research team has identified certain search terms that have returned the greatest number of malicious sites and has developed several tips for combing through search terms.

“Cybercriminals use whatever is at their disposal to spread malware. In this instance they are launching attacks against Google’s top search terms that identify the most popular stories of the day,” said Deepen Desai, Lead Malware Researcher, SonicWALL. “These criminals are now going after these top search terms using their knowledge to insert malware infected websites almost immediately after people show interest in a particular news site.”

Using social engineering tactics, cybercriminals are able to jump onto the latest news events ranking high on Hot Search to draw more traffic to their infected websites. Search Engine Optimization (SEO) tactics are then used to make the websites show up higher in the search results, thus making it more likely that individuals will click on them.

The counter offensive to remove these threats is on-going. However, some sites have remained within search results for a number of hours before being removed. Recent and topical infected searches include:

  • A search on “elinor burkett” within a 24 hour period between March 8th and 9th presented 40 unique malicious URLs appearing in Google search’s top 30 results.
  • A search on “the new tenants” on March 8th presented 56 unique malicious URLs appearing in Google search’s top 30 results.

SonicWALL suggests you remember the following tips when searching for a news event:

  • Be diligent when clicking on the links that show up in search engine results. Be sure to look at the URL before you click on it. Quite often the legitimate sites show up with complete readable sentences in their description whereas the malicious sites show up with jumbled keywords.
  • If you do click on a malicious website, quickly get out of it. Most of the malware found redirect to fake antivirus websites that pretend to discover malware on a computer and offers to sell antivirus software that will clean it up.
  • Make sure that your antivirus is up to date. Use defense-in-depth by layering protection, having antivirus both on the gateway and the client.
  • Steer clear of any kind of video codecs or protection software executables downloads prompted by most of these sites.
  • Do not execute any files that come through e-mail attachments.

For more information and to track the latest network and e-mail security threats, go to: http://www.sonicwall.com/securitycenter.asp?tab=NS

Tags: , , , ,

Top 10 Malware Threats for January

February 4, 2010 · Filed Under Security Software, Software News · Comment 

Leading anti-malware developer finds continued prevalence of Trojan horse programs

Sunbelt Software announced the top 10 most prevalent malware threats for the month of January 2010. The report, compiled from monthly scans performed by Sunbelt’s award-winning anti-malware solution, VIPRE® Antivirus + Antispyware, and its antispyware tool, CounterSpy®, is a service of SunbeltLabs(TM).

In January, the malware landscape remained remarkably similar to December, according to Sunbelt Software ThreatNet statistics. The top seven detections were the same as December, but in a slightly different order. In December and January, six of the top 10 detections were Trojan horse programs.

Trojan.Win32.Generic!BT – a generic detection for Trojans that comprised nearly one quarter (23.15 percent) of all the malware found. It remained in the top position for the third month in a row, growing by nearly 20 percent from 18.69 percent of all detections in December. It is a detection that includes many downloaders associated with scareware or rogue security products.

After holding the top spot on the list for most of 2009, the password-stealing Trojan-Spy.Win32.Zbot.gen held the second position on the list for the third consecutive month, decreasing from 6.23 to 4.91 percent of all detections.

“I think we can expect to see Trojan horse programs continue to be the top detections for the foreseeable future,” said Michael St. Neitzel, Sunbelt Software vice president of Threat Research. “Trojans used to download and install a wide variety of other malware and those are the real moneymakers for the bad guys.”

Other Trojans in the top 10 were:
– Trojan.Win32.Generic!SB.0
– Trojan.Win32.Malware
– Trojan.ASF.Wimad (v)
– Trojan.HTML.FakeAlert.a (v)

Meanwhile, three new detections moved onto this month’s top 10 list. Virtumonde — a generalized description of an adware program with many versions of pop up advertising — constituted 1.23 percent of overall detections. Packed.Win32.TDSS.aa.3 (v) — a sophisticated rootkit and Trojan that is used primarily to redirect search engine results — made up 1.21 percent. Finally, Trojan.HTML.FakeAlert.a (v) — a detection for an HTML file which replaces a desktop background and works with other rogue malware — made up just under one percent of all detections.

The top 10 results represent the number of times a particular malware infection was detected during VIPRE and CounterSpy scans that report back to ThreatNet, Sunbelt’s community of opt-in users. These threats are classified as moderate to severe based on method of installation among other criteria established by SunbeltLabs. The majority of these threats propagate through stealth installations or social engineering.

The top 10 most prevalent malware threats for the month of January are:
1. Trojan.Win32.Generic!BT 23.15%
2. Trojan-Spy.Win32.Zbot.gen 4.91%
3. Exploit.PDF-JS.Gen (v) 4.55%
4. Trojan.Win32.Generic!SB.0 2.40%
5. Trojan.Win32.Malware 1.93%
6. Trojan.ASF.Wimad (v) 1.92%
7. INF.Autorun (v) 1.46%
8. Virtumonde 1.23%
9. Packed.Win32.TDSS.aa.3 (v) 1.21%
10. Trojan.HTML.FakeAlert.a (v) 0.98%

Source: Sunbelt Software

Tags: , , , , ,

Next Page »