If you're wrestling with malware infections on your website, then
you have company. Lots and lots of company.
According to a new report published in a blog today by researchers
at security firm Dasient, the number of websites infected by
malware in the second quarter of 2010 spiked to more than 1.3
million -- the first time that figure has ever topped 1
million.
"That's a jump of almost two times the number that we saw in the
previous quarter," says Neil Daswani, co-founder of Dasient. "The
numbers are really surprising."
Malware authors are becoming more efficient and creative in their
methods of attacking websites, Dasient says. For one thing, they
are creating new malware at an exceedingly rapid rate: Dasient
detected more than 58,000 new infections in Q2 alone, raising its
comprehensive malware library to more than 200,000 different
infections.
Attackers are also becoming more crafty in the way they distribute
their payloads, Daswani observes. For example, many malware authors
have begun deploying new infections late on Friday afternoons, when
they know most IT departmental resources will be at an ebb over the
weekend.
"They can make the campaign last longer by starting it right before
a weekend," Daswani says. The average malvertising campaign in Q2,
for example, lasted 11.5 days.
Malvertising itself continues to grow, Dasient says: More than 1.6
million malvertisements are served on an average day, up 20 percent
in the second half of Q2, according to the report. Some 42 percent
of websites rely on third-party advertising resources, yet many
site operators do not vet this content for malware before they
serve it, Daswani notes.
Attackers favored JavaScript over iFrames as a means of delivering
malware in Q2, according to the report. "In Q2, over 43,000
JavaScripts and over 15,000 IFRAMEs were added to Dasient’s
infection library," Dasient says. "As a percentage of the total
number of new entries, JavaScript samples have increased by 19
percent, and JavaScript samples now make up 74 percent of the
entries for the quarter [as compared to 55 percent three quarters
ago]."
"One of the advantages of JavaScript is that it can be used to
modify a whole Web page, whereas an iFrame is more limited,"
Daswani says. "JavaScript offers a larger attack surface."
Attackers use .com and .cn domains most frequently to host
malicious code, Dasient says. In Q2, there was a rise in .info
domains that were infected and used to host malicious code, the
report states.
Three out of four drive-by-downloads have one letter filenames and
are written to the User's Application Data directory, according to
Dasient. The most common name for a drive-by-download was
f.exe.
The level of attack sophistication is going to only increase over
time, Daswani says. "This is a problem that isn't slowing down," he
says. "It's not going away."