Feeds

Unsung software developers behind rise in online fraud

Tool kits spark explosion in malicious code base, says Symantec

High performance access to file storage

One weekend in June, a little-known Trojan downloader made a major debut on the international malware stage after it managed to burrow its way into more than 10,000 websites in just 72 hours. Infected sites - including one connected to rock musician Bon Jovi and another that raises money for charity work of the late Mother Teresa - suddenly became the agents of Russian crime gang, as they pushed malware on unsuspecting visitors.

The outbreak was the handiwork of MPack, an easy-to-use malware toolkit that sells for as much as $1,000. MPack, which has gone on to infect as many as 500,000 websites, according to some estimates, typifies many of the findings of a new report by security provider Symantec, which analyzes trends in internet-based threats for the first six months of 2007.

From January to June, Symantec counted slightly more than 212,000 new samples of malicious code, an almost three-fold increase from the last six months of 2006 and a more than four-fold increase from the first half of that year. According to Oliver Friedrichs, director of emerging technologies for Symantec's security response, the growth would have been impossible without the help of MPack and kits of similar ilk.

"With the improvements in operating system security and security software ... attackers are increasingly needing to attract a higher volume of variants to avoid detections," he said. The increase "is definitely driven by the attackers trying to evade".

As the bad guys get forced into a corner, they are increasingly relying on professionally developed tool kits such as MPack to ratchet up the number of exploits they throw out.

The modus operandi of MPack also typifies at least two other growing trends in online fraud. The first is the use of trusted online sites, which lower the guard of otherwise savvy web surfers. Increasingly, legitimate sites are being compromised so they infect the users who visit them, a practice that differs from older methods that relied on porn or warez sites to push malware.

"It used to be good enough to avoid visiting the seedier sides of the internet. That's not the case anymore," Friedrichs said. Attackers are "increasingly leveraging mediums you or I wouldn't think twice about in order to subvert you."

MPack also exemplifies the move to multi-staged attacks, described in the report as compromises that "establish a beachhead from which subsequent attacks are launched". Like other toolkits, MPack stitches together many individual attacks that exploit websites and clients. The goal: to better penetrate a user's defenses and tailor the attack to a specific objective, such as obtaining online banking credentials or provide personal details to be used for identity theft.

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.