September records 72% email-borne malware – Report

The results of the September 2011 edition of Symantec Intelligence Report has revealed that 72 per cent of electronic mail (email)-borne malware.

Malware is short form of malicious software, which consists of programming; code, scripts, active content, and other software, designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior.

Also, Malware is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.

Senior Intelligence Analyst, Symantec.cloud, Mr. Paul Wood, noted that September’s analysis reveals that a deluge of malicious email-borne Malware has left a clear mark on the threat landscape for September.

According to him, approximately 72 per cent of all email-borne malware in September could be characterized as aggressive strains of generic polymorphic malware, first identified in the July Symantec Intelligence Report.

At the end of July, he said, this rate was 23.7 per cent, in August but it fell slightly to 18.5 per cent before soaring to 72 per cent in September.

“This unprecedented high-water mark underlines the nature by which cyber criminals have escalated their assault on businesses in 2011, fully exploiting the weaknesses of more traditional security countermeasures,” he said.

Further analysis, he said, also revealed that the social engineering behind many of these attacks has accelerated, with the adoption of a variety of new techniques such as pretending to be an email from a smart printer and scanner being forwarded by a colleague in the same organization.

Equally, he said, the idea of an office printer sending malware is perhaps an unlikely one, as printers and scanners were not actually used in these attacks, but perhaps this sense of security is all that is required for such a socially engineered attack to succeed in the future.

Wood said although spam levels remained fairly stable during September, Symantec Intelligence observed the use of identified vulnerabilities in certain older versions of the popular WordPress blogging software on a large number of web sites across the Internet.

Spam emails, he said, contained links to these compromised web sites were also being spammed out.

“It is important to note that blogs hosted by WordPress themselves seem to be unaffected,” he explained.

Emphasising that the exploitation of these vulnerabilities to serve spammers’ interests is a stark reminder for the need to ensure software is up-to-date with latest patches and releases.

Additional research, he said, revealed that JavaScript is becoming increasing popular as programming language by spammers and malware authors.

“JavaScript is increasingly used to conceal where spammers are redirecting, and in some cases, also to conceal entire Web pages,” he said, stressing that for spammers, hosting simple JavaScript obfuscation pages on free hosting sites could increase the lifetime of that site before the site operator realizes the page is being used for malicious activity.

“JavaScript is popularly used for redirecting visitors of a compromised Web site to the spammers landing page. While some of these techniques have been common in malware distribution for some time, spammers are increasingly using them,” Wood said.

Remmy Nweke

ITREALMS Online ... delivering news for ICT4D