Web Threats Are Evolving: Are You?

Mark Tickle

Mark Tickle, 02/11/2009, posted in "Analysis"

Mark Tickle is managing director for SaaS in EMEA at Webroot, responsible for sales operations and channel strategy. Formerly, Mark held the position of sales director at Websense and ...more info

Mark Tickle is managing director for SaaS in EMEA at Webroot, responsible for sales operations and channel strategy. Formerly, Mark held the position of sales director at Websense and senior sales and management positions at BlackSpider, SurfControl and Vignette. Mark has a degree in Marketing and an MBA from Hull University. ...less info

• Tweet
• Email

• Tweet
• Email

The Internet is called a bad neighbourhood and today, we know just how bad it really is. My company’s Threat Research Centre recently analysed malicious Web sites and found that one in 12 sites online today should be blocked for inappropriate content. Simply telling your employees which Web sites they can and cannot go to during work hours is not enough—the problem is much more complicated.

Thanks to increasingly sophisticated techniques employed by commercially-minded online criminals, Web threats are turning up in unexpected places including the Web pages of major news organisations, government organisations and social networks.

Unexpected ‘gifts’

‘Drive-by downloads’ have become a significant problem in the past few years, as criminals worked out how to write software scripts that analyse which browser and operating system a visitor to a Web site is using. The scripts then tailor specific downloads which are delivered automatically to the browser, causing it to become infected. Until recently this might only have been a problem for people visiting unsavoury parts of the Web. However, now malware writers can also infect legitimate Web sites.

Using SQL injection, criminals craft a malicious database query which causes content to be injected into a Web site’s database. Because many Web sites these days draw their content from a database, malware writers can use this technique to introduce HTML commands into a Web page.

HTML commands can be used to make the browser surreptitiously visit another site. That site, operated by the criminals, then delivers the attack. BusinessWeek, the New York Times, CNET and even the United Nations’ Web sites have been made to serve up malware as drive-by downloads.

Criminals are also using search engine optimisation to up the ante by injecting content into legitimate Web sites designed to make them appear at the top of search rankings. They can “poison” search results to make those sites turn up in searches relating to current events. Sites unrelated to current events and trending topics like Michael Jackson’s death, can show up in search results and deliver drive-by downloads to visitors.

These techniques are used to throw up “scareware” advertisements that persuade unwitting users to purchase and install rogue antivirus products. These products do little or nothing to protect systems, but create sales revenue for the perpetrators, who have been known to double-charge the victims’ credit cards.

Even social networking sites such as Facebook carry significant threats. Criminals using the service’s application programming interface are producing plug-in applications that can use malicious code to spread Internet worms from one account to another. Koobface, a malicious Facebook application released late 2008, spreads itself throughout the system, and attempts to persuade users to download malware that will exploit programs on their desktops.

Fighting back

Tackling threats involves technical and organisational measures. On the technical side, employees can be protected at three levels. Installing anti-malware protection on the desktop is the last line of defence. Gateway-level protection can scan the Web for suspicious sites and malware scripts before the date ever hits an employee’s PC. Finally, protection “in the cloud” happens on the Internet via a managed services provider.

Each of these has their benefits. Desktop protection is effective when trying to stop malware being introduced via portable media such as USB keys. Protection in the cloud can draw on far more resources than are available at the gateway or desktop level.

It is important to educate staff about the appropriate use of online resources within an organisation. Social engineering techniques such as phishing can lure employees into giving up passwords that can then be used for identity theft and spam. Recently, tens of thousands of Webmail addresses, culled from users of Hotmail, Yahoo, and Gmail, were found online that had been used to spam people on the victims’ contact lists.

Employees should be instructed not to try installing unknown software like video codecs delivered by Web sites. Even PDF files sent from unknown sources can potentially compromise flaws in desktop software, and be used to compromise a machine.

These threats call for organisations to create an online policy that outlines what is and is not permissible—and back it up with technical solutions to enforce policy as much as possible. Many modern content scanning systems feature administrative options that can prevent employees from surfing certain categories of Web site, and can also query online databases of known malicious sites to block threats.

Just as when visiting a new city, companies must treat the Internet with caution, and beware of any new, unexplored places that their employees may visit. A combination of technical protection, and common sense drummed into employees, should help keep the criminals from your network—and your sensitive data from leaking into the public domain.