Jan 2012 Threats Trend Report

Internet ThreatsTrend ReportJanuary 2012

January 2012 Threat Report The following is a condensed version of the January 2012 Commtouch Internet Threats Trend Report You can download the complete report at http://www.commtouch.com/threat-report-january-2012Copyright© 2011 Commtouch Software Ltd. Recurrent Pattern Detection, RPD, Zero-Hour and GlobalView are trademarks, andCommtouch, Authentium, Command Antivirus and Command Anti-malware are registered trademarks, of Commtouch. U.S. PatentNo. 6,330,590 is owned by Commtouch.

January 2012 Threat Report1 Key Highlights Facebook Attacks 2 Feature – The year in review Malware, Spam, Web Security, 3 Trends Compromised Websites and Zombies

Key Highlights for Q4 2011

Key Security HighlightsAverage daily spam/phishing emails sent 101 BillionSpam levels increased marginally in November and December 2011

Key Security Highlights Spam Zombie daily turnover 209,000 Zombies A very large decrease compared to the 336,000 in Q3(Zombie turnover is the number of zombies turned off and on daily)

Key Security Highlights Most popular blog topic on user generated content sites Streaming media/ downloads (22%)Streaming media & downloads remains in top spot but dropped 2% from Q3Includes sites with MP3 files or music related sites such as fan pages (these might also be categorized as entertainment)

Key Security HighlightsMost popular spam topic Pharmacy Ads (31%) Up 2% over Q3

Key Security Highlights Country with the most Zombies India (23.5%)India increased its share in Q4 to nearly one quarter of the world’s zombies

Key Security Highlights Website category most likely to be compromised with malware Parked Domains“Parked domains” and “Portals” remained inthe top 2 positions with “pornographic sites” in 3rd position

Feature… Facebook Attacks – The year in review

Facebook Attacks – 2011 Facebook Attacks in 2011• Continues to be an attractive target for attacks from malware distributors, scammers and plain old jokers• Most Facebook attacks ultimately lead victims to affiliate marketing/survey sites• Q4 2011 saw increases in free-merchandise scams

Lifecycle of Facebook Attacks The 3 Stages of Facebook Attacks Stage 1 – The Catch TheCatch Enticing offer or information inspiring action by a Facebook user Spreading Stage 2 – Spreading the Attack the Ensure the attacks continues/spreads Attack Stage 3 – The Goal The Goal What the cybercriminals wants to gain or achieve

The Catch - 4 Tactics The 4 ways Facebook users are tricked into “liking”, following a link or adding add an app1. Free goods – Items ranging from headphones to gift cards to unreleased Facebook phones2. Sensational headlines on current news issues Examples: – Death of Osama Bin videos – Death of Steve Jobs “free iPad/iPhone” scams

The Catch - 4 Tactics3. Must see tragic/amazing events with call to action – Users follow a link, or click on Like to see a shocking video/photo, or forward a chain message The Spanish in the example above translates to “Look what happens”.4. Must-have Facebook app download Example of popular attack: – Mythical app allowing users to see who has been viewing their profile and get a breakdown of boy and girl views of their profile

The Catch – Summary Summary of Catch Tactics• Social engineering is the key to the tactics used to “catch” Facebook victims• The tactics are spread nearly evenly between the four tactics described above – Most used tactic – “must see this” (36%) – Most common tactic in second half of 2011 – 26 “free stuff” (26%)

Spreading Attacks How Facebook Attacks are Propagated• Cybercriminals abuse the inherent trust of Facebook friends• 4 main methods for spreading attacks: 1. Tricking users into sharing 2. Likejacking 3. Rogue applications 4. Malware and “self-XSS”

Spreading AttacksTricking users into sharing• Users aware that they are liking/sharing a page, but do so under false pretenses• Example attacks: – Scams promising free gift cards in exchange for like/share – Users post a hoax they believe to be true warning other users about a (nonexistent) virus or telling them the sad tale of a (nonexistent) abused child

Spreading AttacksLikejacking• A common tactic is to entice users to see a video• The video player may be functional but the page includes scripts that use any mouse click to generate a “like”• Users unaware that they have liked a page, but the “like” is used to lead more friends to the video

Spreading AttacksRogue applications• Apps users believe provide worthwhile functionality – Example: An app promising to reveal who has been viewing your profile• Users grant these apps permission to access parts of their user profile as well as post on their wall – Wall posts are then used by the rogue app to spread out further within Facebook

Spreading AttacksMalware and “self-XSS”• Malware unwittingly installed a users PC hijacks their Facebook session for posts and other activity• How it works – Traditional cross site scripting (XSS) attacks rely on a hidden script within a webpage to hijacks a Facebook session – Self-XSS means that malicious script was activated by a user (the “self”) giving another site access to the Facebook session

Spreading Attacks– Users are tricked into activating a script by copying it directly into their browser– In most cases scripts will direct to an external site (the “cross-site” of “cross-site scripting”) and then post a wall post or an event invite, which others view and in turn help to further propagate the attack

Goal of Attacks Goal of the Facebook AttackThe goal of Cybercriminals with Facebook attacks canbe divided into the following categories:• Marketing affiliate/survey sites• Chain posts and hoaxes• Other

Goal of AttacksMarketing affiliate/survey sites• Benefit to Cybercriminals: – Affiliate payments for driving users to specific sites – Collection of personal data to be used in identity theft• Users are led to believe that completion of a form will result in a free gift (iPhone, gift card, cap, etc.)• They may also be tricked into signing up for unwanted products

Goal of AttacksChain Posts and Hoaxes• The Benefit to Cybercriminals: – Pranksters having a laugh at the expense of unaware Internet users• Users like or share stories of abused children or devastating computer viruses• Many of the fake stories were email chain emails many years ago and have been reused

Goal of AttacksOther types of attack• Defacement – Benefit to Cybercriminal: Embarrass Facebook• Spreading malware – Benefit to Cybercriminal: Spread malware that steal passwords or sends spam• Collecting Likes – Benefit to Cybercriminal: Generate an enormous number of likes of a page (several hundred thousand in some cases) but with no clear further malicious purpose

Facebook Attacks Summary Summary of 2011 Facebook AttacksSome progress made during 2011 to stop attacks• Various attacks more quickly detected and removed by Facebook• Almost no recent reports of rogue applications compared to the numerous examples from the first half of the year• Some attack methods, such as the self-XSS, almost completely eliminated (due to security updates by major browser vendors)• “Free merchandise” scams are still common

Q4 Malware Trends For a complete analysis of Facebook attacks in 2011, download the complete January 2012 Internet Threats Trend Reporthttp://www.commtouch.com/threat-report-january-2012

Trends in Q4 2011… Malware Trends

Q4 Malware Trends• The large amounts of email-malware in 2011 were a surprise to many analysts • Analysts had predicted the continued demise of the spam threat vector following a quiet 2010• The mass Malware-attachment outbreaks of late Q3 subsided in Q4, as can be seen in the chart below• Multiple “blended threat” email outbreaks were tracked by Commtouch in Q4 • Involved emails and malware hosted on compromised websites

Q4 Malware TrendsMalware email levels – Jan to Dec 2011 Source: Commtouch

Q4 Malware Trends Top 10 Malware of Q4 2011Rank Malware name Rank Malware name 1 W32/Swizzor-based!Maximus 6 W32/MyWeb.D 2 W32/Brontok.A.gen!Eldorado 7 W32/Tibs.K.gen!Eldorado 3 JS/IFrame.HC.gen 8 W32/Mabezat.A-2 4 W32/Virut.9264 9 W32/Virtumonde.T.gen!Eldorado 5 W32/Heuristic-210!Eldorado 10 W32/Mywebsearch.B.gen!Eldorado Source: Commtouch

Q4 Malware Trends For a complete analysis of Malware in Q4 and thespecific attacks employed, download the complete January 2012 Internet Threats Trend Report http://www.commtouch.com/threat-report-january-2012

Trends in Q4 2011… Spam Trends

Q4 Spam Trends • Spam levels increased marginally in Nov & Dec but remained at their lowest in years following the Rustock botnet takedown in March • Q3 average spam levels approached 101 billion email messages Spam levels – Jan to Dec 2011Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Source: Commtouch

Q4 Spam Trends• Spam averaged 77% of all emails in Q4 (excluding emails with malware attachments) Spam % of all emails - Jan to Dec 2011 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Source: Commtouch

Q4 Spam TrendsNovember Spam Tactics– Sending spam containing URLs not yet registered• Several hundred million emails sent out with many thousands of unregistered URLsHow it Works• Spam filters with URL reputation systems check if URLs are registered and when they were registered – Bad sites usually have registrations that are only several hours old• If a site is not registered when checked, many URL reputation systems will not blacklist the site and not pursue further checks• This loophole allows spammers to send out emails linking to unregistered URLs and then register them an hour or so after the outbreak in order to prevent the URLs from being blocked

Q4 Spam TrendsTop Faked (Spoofed) Spam Sending Domains* • Gmail.com once again the most spoofed domain • Facebook related addresses (unsubscribe.facebook.com) and facebookmail.com both feature in the top 15 (often part of phishing or malware attacks) * The domains that are used by spammers Source: Commtouch in the “from” field of the spam emails.

Q4 Spam Trends Spam Topics• “Pharmacy spam” increases for second straight quarter (about 2% over Q3) reaching 31% of all spam• Dating related spam increased from 2.3% to nearly 12% in the last quarter of the year Source: Commtouch

Q4 Spam TrendsFind out more about Spam Trends in Q4 by downloading the complete January Internet Threats Trend Reporthttp://www.commtouch.com/threat-report-january-2012

Trends in Q4 2011… Web Security

Q4 Compromised WebsitesTrend: Compromised Websites Store Malware• Most of the emails carrying malware links in Q4 used compromised websites• Example: The “speeding fine” link directs to JavaScript malware on a legitimate site called “jemgaming.net”. Source: Commtouch

Q4 Compromised WebsitesTrend: Compromised sites used as redirect points to pharmacy and enhancer websites• Majority of the exploited sites were using the WordPress content management system• Spammers exploited a vulnerability in WordPress or in a plugin in order to hide the redirect pages• Before being redirected users are shown an initial page hidden within one of the WordPress subdirectories (see image below)

Q4 Compromised WebsitesCompromisedsite showsmessage beforeredirectingDestinationenhancer siteHomepage of thecompromisedWordPress sitewith no changein functionality

Q4 Compromised Websites Website categories infected with malware • Parked domains and Portals remained in the top 2 positions with pornographic sites in 3rd position (As noted in previous reports, the hosting of malware may well be the intention of the owners of the parked domains and pornography sites) Rank Category Rank Category1 Parked Domains 6 Entertainment2 Portals 7 Shopping3 Pornography/Sexually Explicit 8 Health & Medicine4 Education 9 Travel5 Business 10 Computers & Technology Source: Commtouch Portals category includes sites offering free homepages, which are often abused to host phishing and malware content or redirects to other sites with this content

Q4 Compromised Websites Website categories infected with phishing• This is an analysis of which categories of legitimate Web sites were most likely to be hiding phishing pages (usually without the knowledge of the site owner)• Sites related to games ranked highest in Q4, similar to Q3 Rank Category Rank Category 1 Games 6 Sports 2 Portals 7 Business 3 Shopping 8 Leisure & Recreation 4 Education 9 Entertainment 5 Fashion & Beauty 10 Real Estate Source: Commtouch Portals category includes sites offering free homepages, which are abused to host phishing and malware content.

Q4 Compromised Websites Download the complete January 2012 Internet Threats Trend Report for more detailshttp://www.commtouch.com/threat-report-january-2012

Trends in Q4 2011… Zombie Trends

Q4 Zombie Trends Daily Turnover of Zombies in Q4• Q4 saw an average turnover of 209,000 zombies each day that were newly activated for sending spam• A very large decrease compared to the 336,000 of Q3 2011• Average turnover for all of 2011 – 297,500 zombies per day Daily newly activated spam zombies: Jan to Dec 2011 Source: Commtouch

Q4 Zombie Trends Worldwide Zombie Distribution in Q4 Source: Commtouch• India again claimed the top zombie producer title, increasing its share to nearly a quarter of the world’s zombies• Brazil, once a fixture in first position, continued to drop – this quarter to 6th position (a further drop of around 3%)• Peru and Kazakhstan joined the top 15, displacing Saudi Arabia and Columbia

Q4 Zombie Trends Download the complete January 2012 Internet Threats Trend Report for more detailshttp://www.commtouch.com/threat-report-january-2012

Trends in Q4 2011… Web 2.0 Trends

Q4 Web 2.0 Trends Web 2.0 Trends • “Streaming media and downloads” was again the most popular blog or page topic, but dropped 2% in Q4Rank Category Percentage Rank Category Percentage 1 Streaming Media & Downloads 22% 8 Arts 5% 2 Computers & Technology 8% 9 Sports 4% 3 Entertainment 7% 10 Education 4% 4 Pornography/Sexually Explicit 6% 11 Leisure & Recreation 3% 5 Fashion & Beauty 5% 12 Health & Medicine 3% 6 Restaurants & Dining 5% 13 Games 3% 7 Religion 5% 14 Sex Education 2% Source: Commtouch The streaming media & downloads category includes sites with MP3 files or music related sites such as fan.

Review of Q4 2011

Review of Q4 2011 October November December Lowest Mostspam per Speeding Spam ratio Phony airline spam per Better ticket email- reaches low Facebook itineraries lead Facebook day: 138 business day: 60 malware of 73% defacement to malware free gift billion bureau billion attack card scams malware Pizza Free iPhone Compromised ACH malware Unregistered “look what scams WordPress transaction James domains used happens” following sites host cancelled Cameron in spam Facebook death of malware malware new movie emails bikini girl Steve Jobs emails malware likejacking Source: Commtouch

Download the complete January 2012 Internet Threats Trend Report athttp://www.commtouch.com/threat-report-january-2012

For more information contact: info@commtouch.com 650 864 2000 (Americas) +972 9 863 6895 (International) Web: www.commtouch.comBlog: http://blog.commtouch.com

http://www.commtouch.com	2410
http://performinsider.com	659
http://geeksroom.com	478
http://www.blogdumoderateur.com	400
http://www.protezioneaccount.com	289
http://www.webrazzi.com	277
http://aristo.co	171
http://www.ddsmedia.net	95
http://feeds.feedburner.com	54
http://www.marketingbyann.net	48
http://menlotechnical.wordpress.com	29
http://feeds2.feedburner.com	16
http://blog.ht-ar.com	14
http://www.netvibes.com	8
http://translate.googleusercontent.com	6
http://www.twylah.com	5
http://www.teknofikir.com.tr	4
http://us-w1.rockmelt.com	4
http://www.banadersanlat.com	4
http://banadersanlat.com	3
http://127.0.0.1	2
http://sosyalmedyabulteni.com	2
http://www.heureka.com.ve	2
http://www.blogger.com	2
http://www.newsblur.com	1
http://mediablogrueil.blogspot.com	1
http://10.9.65.3:15871	1
http://feedproxy.google.com	1
http://bagtheweb.com	1
http://inter-network.net	1
http://207.46.192.232	1
http://teknofikir.com.tr	1
http://pigeindexermau	1
https://webmail.cfwb.be	1
http://translate.google.com	1
http://127.0.0.1:8795	1
http://webcache.googleusercontent.com	1

Jan 2012 Threats Trend Report

by Commtouch on Dec 28, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

37 Embeds 4,995

Statistics

Jan 2012 Threats Trend Report — Presentation Transcript