During the second half of 2009, attackers shifted their strategy away from mass-injection campaigns and instead focused on launching targeted attacks to infect high-profile websites, concluded Websense's State of Internet Security report for the third and fourth quarter of 2009, released Thursday.
There was a sharp increase in the number of infected websites during the first half of last year, when attackers launched the mass-injection campaigns Gumblar, Beladen and Nine-Ball. But then, from July until December, the number of malicious websites decreased 3.3 percent compared to the first half of the year.
“It doesn't necessarily mean things are getting better,” Patrik Runald, senior manager of security research at Websense, told SCMagazineUS.com on Wednesday. “The bad guys are going after high-profile, high-volume websites, instead of going after the smaller websites, which are easier to inject code into.”
There was an increase in attacks on highly trafficked sites such as Web 2.0 properties and news organizations during the second half of 2009, Runald said. Hackers have realized that targeting fewer websites, but ones with higher traffic, can be more efficient and effective, the report states.
Also, during the same period, attackers increasingly launched targeted attacks, which often start with an email containing a malicious link.
One such high-profile attack called Operation Aurora leveraged a previously unknown vulnerability in Internet Explorer to compromisesystems at Google, Adobe and more than 30 other large companies.
During the second half of 2009, 81 percent of email contained a malicious link, the report states. In addition, 58 percent of all data-stealing attacks were conducted over the web.Websense predicted that blended attacks attempting to steal sensitive information and attach compromised machines to botnets will increase over the next 12 months.
