Malware Attacks Getting Much Worse

Saturday, 03 February 2007

Increasingly, organized crime rings, including many in Russia, China and South America, are behind computer viruses, spam and scams. With the wherewithal to hire high-tech help and manage major operations, their techniques have quickly made many security software programs -- perhaps including the ones you might have on your home or office PC -- obsolete. Forget the antivirus software, the crackdowns on "spam" and "spoofing" and "phishing," and all the attempts by computer companies to build more secure machines. Hacks and attacks on our PCs are getting worse, not better. The numbers are alarming: -Unsolicited e-mail "spam" rose 147 percent last year from a year earlier, and now accounts for 94 percent of all e-mail traffic, according to e-mail security company Postini Inc. -Incidents of viruses and other malware rose nearly 40 percent last year, with new vulnerabilities popping up at the rate of 20 a day, another Internet security company reports. -The number of known phishing sites, designed to look like legitimate banking or e-commerce sites in order to steal credit card information, soared to more than 37,400 at the end of last year -- eight times the number a year earlier. -Hackers are surreptitiously hijacking home and business PCs across the globe in record numbers. An estimated 1 million computers are now secretly used as "bots" to spew spam, viruses and other maladies across the Web. Beginning Monday, some of the technology industry's top minds will gather in San Francisco at an annual computer security conference to discuss and show off new ways to combat the growing threats to our PCs. But if history is any indication, sophisticated hackers will figure out how to evade new defenses almost as soon as they're introduced. "Every new technology we come out with against a new threat, the hackers learn pretty fast and extend their technology" to get around it, said Gunter Ollmann, director of security strategy for Atlanta-based IBM Internet Security Systems. "I wouldn't say we're losing the war, but they're certainly making us work harder." Spam is a good example. Unsolicited e-mails have been around almost as long as e-mail itself. Every year, some new technology or new law (like the 2003 federal CAN-SPAM Act) is supposed to prevent it. Yet spam keeps getting worse, partly because hackers are growing more sophisticated. While hacking used to be about kids defacing Web sites or sending out viruses just to see the effect, most of today's Web attacks are designed to avoid attention and generate profits. For example, the latest trick by spammers is to use software that automatically makes tiny changes in every e-mail -- a letter here, a pixel there -- to circumvent common antispam programs. "Now it's all about the money," said Andrew Jaquith, an analyst with technology researcher Yankee Group. Jeanson J. Ancheta, a 21-year-old hacker from California, made more than $100,000 from Internet advertising companies who paid him to download their malicious "adware" onto more than 400,000 PCs he had surreptitiously taken over around the globe, according to authorities. He made tens of thousands more dollars farming out his "botnet" machines to companies that used them to spew spam, viruses and other malware onto the Internet. Last May, Ancheta, who belonged to a group called the "Botmaster Underground," was sentenced to five years in prison in the first U.S. prosecution of its kind. Increasingly, organized crime rings, including many in Russia, China and South America, are behind computer viruses, spam and scams. With the wherewithal to hire high-tech help and manage major operations, their techniques have quickly made many security software programs -- perhaps including the ones you might have on your home or office PC -- obsolete. "This is the arms race between the good guys and the bad guys that is still playing out," said Mark Sunner, chief security analyst for Web security company MessageLabs. "When it comes to the more traditional software methods, many companies are increasingly finding it just isn't working any more." As a result, companies are working on new approaches. MessageLabs and Postini, for instance, now push a "multi-layered" approach to security that includes not only searching for keywords in an e-mail that might indicate spam or a virus, but also analyzing the "behavior" of that e-mail and factors such as when it was sent, from whom and to whom. Microsoft Relevant Products/Services Corp. claims its new Vista computer operating system will go a long way toward making PCs more secure. Vista, which hit store shelves last Tuesday, is designed to make it harder for viruses and worms to attach to the "kernel," the guts of the operating system. That protects a computer and also helps keep malware from accessing programs like address books that can let them spread. But nobody, even inside Microsoft, suggests Vista is immune to hackers. At industry conferences, some hackers have already shown off potential exploits of earlier test versions of Vista. On Web sites, others have promised bounties for anybody who can figure out how to break into the new system. "There's a lot of great new stuff in there, a lot of new things -- all which is virgin territory for people to find security vulnerabilities that can be exploited in the future," Ollmann said of Vista. George Tubin, senior analyst at TowerGroup Inc., which does research and consulting for online banks and other financial companies, doesn't see anything slowing the war between hackers and computer security companies any time soon. "Unfortunately, based on history, it's just going to be a back-and-forth battle," Tubin said. "We're never going to get completely on top of it and fix the problem." "It's just going to be a long, long race where we try to stay ahead, with no end in sight," he said. Source: here

 

< Prev		Next >