Malware filters bad for business
- 11 April, 2008 09:12
- Comments 1
Up to 80 percent of Web sites flagged as malicious by anti-virus and search engine indexes are legitimate businesses, according to security experts.
Experts said while the security industry is on top of conventional spam and phishing attacks, more effort needs to be put into preventing and eliminating so-called drive-by-downloads.
The attacks allow hackers to redirect massive amounts of traffic by inserting malicious IFRAMES into legitimate Web sites. The hacks are usually invisible to Web site visitors and do not often draw attention from security personnel because they only require a single line of code to be manipulated.
Sophos CTO Paul Ducklin said affected organisations risk losing business because they are flagged as malicious by search engines such as Google, and anti-phising software.
"You could imagine the business lost if one of only three or four local sign writers were tagged in a search as malicious," Ducklin said.
"It can be very expensive to fix iframe attacks because they can originate externally or internally, and they have a very small footprint."
Compromised Web sites can turn into virtual breeding grounds for further attacks, according to Ducklin, because they are easy targets for hackers wanting to inject additional malicious IFRAMES.
A 2007 Sophos survey found that more than 80 percent of Web sites listed as malicious were legitimate organizations that had been compromised by various attacks including iframe injections.
Ducklin said Sophos "tries to be fair" and revisits Web sites to see if they are still carrying the exploits, but could not specify exactly how long businesses remain blacklisted by security vendors or search engines.
- Bookmark this page
- Share this article
- Got more on this story? Email Computerworld
- Follow Computerworld on twitter
- Customer Case Study: Yarra Valley Water Turns to Enterprise Software to Improve Information Flow
- Print security and the mobile workforce
- 8 reasons why Citrix NetScaler beats the competition
- IDC Whitepaper: Generating Proven Business Value with EMC Next-Generation Backup and Recovery
- Setting a strategy for secure mobile printing
-
The NBN, service providers and you... what could go wrong?
-
NBN build gaining momentum daily: Quigley
-
FTC chairman: Do-not-track law may not be needed
-
Kindle sales soar but Amazon mum on actual numbers
-
Wall Street Beat: IPOs, M&A, chip news stir tech optimism
-
Office 2007 All-In-One Desk Reference for Dummies
-
Computers for Seniors for Dummies, 2nd Edition
-
MYOB Software for Dummies 6E Australian Edition
-
Windows 7 for Dummies®
-
Office 2007 for Dummies
-
Excel 2007 All-In-One Desk Reference for Dummies
-
Windows 7 for Dummies® Dvd+book Bundle
-
Teach Yourself Visually Windows 7
-
Microsoft Office
Comments
Anonymous
Real-time Protection the Solution
Well that's what you get when you use a central database approach to a transient threat. The software is checking a URL against a database of sites that are known to have delivered malware in the past. This approach is too slow to protect against transient threats, especially the one that is gone before it can be recorded into the database. Worse for the operator of the affected site which shows up as infected even after the threat is gone.
We believe the better approach is real-time scanning that inspects each web page for exploits before the user visits it. That's the approach the AVG LinkScanner technology usese. It's more effective against transient threats because it's looking for types of delivery mechanisms rather than types of malware.
The new AVG 8.0 products incorporate the patent pending LinkScanner safe surf and search feature which provides real-time protection against web exploits. See www.avg.com.au
Lloyd Borrett, Marketing Manager, AVG (AU/NZ)
Post new comment