Mass injection web hacks yield to targeted attacks

Share this article:
Malware authors targeting websites have begun trading quantity for quality, according to web security firm Websense.

During the second half of 2009, attackers shifted their strategy away from mass-injection campaigns and instead focused on launching targeted attacks to infect high-profile websites, concluded Websense's State of Internet Security report for the third and fourth quarter of 2009, released Thursday.

There was a sharp increase in the number of infected websites during the first half of last year, when attackers launched the mass-injection campaigns Gumblar, Beladen and Nine-Ball. But then, from July until December, the number of malicious websites decreased 3.3 percent compared to the first half of the year.

“It doesn't necessarily mean things are getting better,” Patrik Runald, senior manager of security research at Websense, told SCMagazineUS.com on Wednesday. “The bad guys are going after high-profile, high-volume websites, instead of going after the smaller websites, which are easier to inject code into.”

There was an increase in attacks on highly trafficked sites such as Web 2.0 properties and news organizations during the second half of 2009, Runald said. Hackers have realized that targeting fewer websites, but ones with higher traffic, can be more efficient and effective, the report states.

Also, during the same period, attackers increasingly launched targeted attacks, which often start with an email containing a malicious link.

One such high-profile attack called Operation Aurora leveraged a previously unknown vulnerability in Internet Explorer to compromise systems at Google, Adobe and more than 30 other large companies.

During the second half of 2009, 81 percent of email contained a malicious link, the report states. In addition, 58 percent of all data-stealing attacks were conducted over the web.

Websense predicted that blended attacks attempting to steal sensitive information and attach compromised machines to botnets will increase over the next 12 months.


Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.

EU conducts massive cyberattack simulation on critical networks

Conducted by the European Union Agency for Network and Information Security, the simulation launched 2,000 attacks on the networks of various critical infrastructure organizations.