Mass injection web hacks yield to targeted attacks

Share this article:
Malware authors targeting websites have begun trading quantity for quality, according to web security firm Websense.

During the second half of 2009, attackers shifted their strategy away from mass-injection campaigns and instead focused on launching targeted attacks to infect high-profile websites, concluded Websense's State of Internet Security report for the third and fourth quarter of 2009, released Thursday.

There was a sharp increase in the number of infected websites during the first half of last year, when attackers launched the mass-injection campaigns Gumblar, Beladen and Nine-Ball. But then, from July until December, the number of malicious websites decreased 3.3 percent compared to the first half of the year.

“It doesn't necessarily mean things are getting better,” Patrik Runald, senior manager of security research at Websense, told SCMagazineUS.com on Wednesday. “The bad guys are going after high-profile, high-volume websites, instead of going after the smaller websites, which are easier to inject code into.”

There was an increase in attacks on highly trafficked sites such as Web 2.0 properties and news organizations during the second half of 2009, Runald said. Hackers have realized that targeting fewer websites, but ones with higher traffic, can be more efficient and effective, the report states.

Also, during the same period, attackers increasingly launched targeted attacks, which often start with an email containing a malicious link.

One such high-profile attack called Operation Aurora leveraged a previously unknown vulnerability in Internet Explorer to compromise systems at Google, Adobe and more than 30 other large companies.

During the second half of 2009, 81 percent of email contained a malicious link, the report states. In addition, 58 percent of all data-stealing attacks were conducted over the web.

Websense predicted that blended attacks attempting to steal sensitive information and attach compromised machines to botnets will increase over the next 12 months.


Share this article:

Sign up to our newsletters

More in News

DDoS attacks remain up, stronger in Q2, report says

DDoS attacks remain up, stronger in Q2, report ...

Prolexic's second quarter DDoS report noted the proliferation of shorter attacks that ate up more bandwidth.

Superman soars above fellow superheroes as most toxic search term

A McAfee study found that searches pertaining to Superman exposed users to the most infected websites.

Black Hat talk on Tor weaknesses canceled

Black Hat organizers say legal counsel for the Software Engineering Institute and Carnegie Mellon University nixed the session.