Mass injection web hacks yield to targeted attacks

Share this article:
Malware authors targeting websites have begun trading quantity for quality, according to web security firm Websense.

During the second half of 2009, attackers shifted their strategy away from mass-injection campaigns and instead focused on launching targeted attacks to infect high-profile websites, concluded Websense's State of Internet Security report for the third and fourth quarter of 2009, released Thursday.

There was a sharp increase in the number of infected websites during the first half of last year, when attackers launched the mass-injection campaigns Gumblar, Beladen and Nine-Ball. But then, from July until December, the number of malicious websites decreased 3.3 percent compared to the first half of the year.

“It doesn't necessarily mean things are getting better,” Patrik Runald, senior manager of security research at Websense, told SCMagazineUS.com on Wednesday. “The bad guys are going after high-profile, high-volume websites, instead of going after the smaller websites, which are easier to inject code into.”

There was an increase in attacks on highly trafficked sites such as Web 2.0 properties and news organizations during the second half of 2009, Runald said. Hackers have realized that targeting fewer websites, but ones with higher traffic, can be more efficient and effective, the report states.

Also, during the same period, attackers increasingly launched targeted attacks, which often start with an email containing a malicious link.

One such high-profile attack called Operation Aurora leveraged a previously unknown vulnerability in Internet Explorer to compromise systems at Google, Adobe and more than 30 other large companies.

During the second half of 2009, 81 percent of email contained a malicious link, the report states. In addition, 58 percent of all data-stealing attacks were conducted over the web.

Websense predicted that blended attacks attempting to steal sensitive information and attach compromised machines to botnets will increase over the next 12 months.


Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.