Security firms report spam increase

Two security firms have revealed that spam attacks have increased in the last quarter.

Secure Computing revealed in its Q3 2008 Internet Threat Report that malware which targets users of social networking sites had become the main source of spam.

It also highlighted the rise in panic-inducing ‘bank failure spam' intending to capitalise on the current financial crisis. ‘Scareware' programs also spread rapidly, while election-related spam soared, with the name Barack Obama featuring in over 80 per cent of election-related spam.

Secure Computing's TrustedSource Labs estimated the number of worldwide U.S. election-related spam email to be approximately 100 million messages per day.

The emergence of ‘Breaking News' spam as a new vehicle that enticed readers to click for breaking news flashes with interesting and provocative headlines was also key, as was misguided ‘Delivery Status Notifications' which made a strong resurgence onto the “Most Common Spam” list.

Secure Computing reported that spam volume returned to record highs in Q3 with fairly steady monthly increases throughout the summer. The acquisition of innocent machines via email and Web-based infections continued in Q3, with over 5,000 new zombies created every hour.

Over the course of Q3, the TrustedSource reputation system was able to identify over 600 new Websites that have been deployed and tagged with a malicious reputation prior to serving any malicious content.

Identifying these Websites proactively through the use of traffic analysis and examination of historical connections to criminal individuals or networks is now essential as they are increasingly used to deploy zero-day/zero-hour malware code that is not detected by the traditional signature-based, anti-malware products.

Meanwhile Sophos revealed that eight times more malicious email attachments were sent out in Q3 2008, particularly within social networking. It revealed that one in every 416 email messages sent between July and September contained a dangerous attachment, designed to infect the recipient's computer – a staggering eight-fold rise compared to the previous quarter where the figure stood at only one in every 3,333 emails.  

It claimed that the worst single attack was the Agent-HNY Trojan horse which was spammed out disguised as the Penguin Panic Apple iPhone arcade game. Other major incidents included the EncPk-CZ Trojan which pretended to be a Microsoft security patch, and the Invo-Zip malware, which

Graham Cluley, senior technology consultant at Sophos, said: “For Apple Mac and Unix lovers, these major spam attacks just mean a clogged-up inbox, not an infected operating system. But organised criminals are causing havoc for Windows users in the hunt for cold hard cash.

Too many people are clicking without thinking – exposing themselves to hackers who are hell-bent on gaining access to confidential information and raiding bank accounts. The advice is simple: you should never open unsolicited attachments, however tempting they may appear.”

As well as using malicious email attachments, cybercriminals have continued to embed malicious links and spam out creative and timely attacks designed to prey on users' curiosity.

For example, in August, Sophos warned of a widespread wave of spam messages claiming to be breaking news alerts from MSNBC and CNN. Each email encouraged users to click on a link to read the news story, but instead, took unsuspecting users to a malicious webpage which infected Windows PCs with the Mal/EncPk-DA Trojan horse.

Cluley said: “When a spam email appears to come from a trusted source, too many users are fooled and end up clicking through to a malicious webpage. The naivety shown by many internet users is downright dangerous.

In the past hackers were more like teenage mischief-makers breaking into sheds to see what they could find. Today they're hardened criminals wearing hobnail boots with no qualms about breaking into your home and stealing everything they can get their hands on.”

See original article on scmagazineuk.com

Copyright © SC Magazine, US edition

firmsnewonreportsecurityspamstatistics