June 17, 2009

Legitimate Websites Suffer Losses Due To Malware

Legitimate websites are becoming a playground for malware, with over 10 million pages being attacked every year.

Security start-up company, Dasient, claims that the threat of malware attacks have increased as more people are creating personal websites and blogs without taking proper security measures.  

Anyone who would open an infected page faces the possibility of having malware downloaded to his or her computer without ever knowing.
Dasient co-founder Neil Daswani said, "There's a real and present danger of the web being seriously compromised."

"This emerging threat is becoming very real and is already affecting millions and millions of websites. 30,000 web pages are affected every day according to the likes of Microsoft and the security firm Sophos," said Mr. Daswani who was a senior security engineer at Google.

Dasient said these issues are not just affecting inexperienced web masters or those trying to curb costs on security measures.

Dasient's Ameet Ranadive a former strategy consultant at McKinsey said, "Today's sophisticated web is much more complex than in the past with richer functionality, third party widgets, video, new sources of content from other places like mash-ups and user generated content." He added, "All these increase the attack surface and the vulnerability for attacks."

He also brought up the fact that hackers are able to cause much more widespread chaos and damage due to their more automated approach.

"In the past they might have targeted one particular website to launch an attack but now they are going after tens of thousands of websites in these aggressive attack waves," said Mr. Ranadive.

StopBadware.com, which is made up of academic institutions, technology industry leaders and volunteers all committed to guarding the Internet and computer users from the abuse of bad software has been sounding an alarm on the issue.

Members include Internet based company giants such as Google, PayPal, AOL and VeriSign.

Manager of StopBadware.com Maxim Weinstein said, "There has been rapid growth in these type of attacks and web based distribution is one of the main ways malware is getting around today"¦the fact however that a given website contains malware does not necessarily mean every user to that site is going to get infected. That malware may require a user to click onto something or exploit a vulnerability on that persons web browser or target a particular operating system."

Dasient says that as this problem intensifies, so does the number of web-based businesses negatively affected.

Companies such as Google, Yahoo and Firefox track infected websites and blacklist them by restricting public access. Then, when a user tries to enter an infected page, an alert known as the "red screen of death" will pop-up as a warning of the dangers of entering the site.

Mr. Daswani says that companies running legitimate websites have no clue that hackers have infiltrated their site.

He stated, "80% of websites hosting malicious software are legitimate and many only find out when a customer tries to log onto the site and can't.

"When a website is infected it can be hard to locate the exact whereabouts of the infection and clean it up. And even if they remove some of the malicious code, the bad guys can re-infect them a couple of days later."

Dasient, which has developed an anti-malware service that protects against blacklisting, says its clients paid a steep price for such attacks in the past.

"We have customers telling us they have lost thousands of dollars by being blacklisted and others saying traffic to their site dropped 95%-98% while on the blacklist," said Mr. Ranadive.

Mr. Weinstein believes that this puts the web's reputation in danger.

"At the extreme, the doomsday scenario is very much a case of people losing trust in the web as a secure platform for business and financial transactions," he said.

"If it's to the point of malware spreading too rampantly, even sources of information will be affected. That's an extreme view and I think a lot is being done to ensure that doesn't happen and to ensure we protect the web and its openness and ability to let people experiment and do new things."

Mr. Weinstein suggested that the industry as a whole needed to work together in order to successfully combat the problem.

"One of the real keys to solving this is that the good guys need to co-operate and share information, share data and communicate with one another more rapidly because we know the bad guys are doing those things.

"We need to make sure we are doing it as well and better than the bad guys," he said.


On The Net: