Sales
0161 215 3700
0800 458 4545
Support
0800 230 0032
0161 215 3711
Fast Chat

Welcome to UKFast, do you have a question? Our hosting experts have the answers.

Sarah Wilson UKFast | Account Manager

Security firm notes alarming rise in malicious codes

Security firm notes alarming rise in malicious codes

Websites rigged with malicious code are becoming more numerous by the day, but the time those sites are online is declining, according to new research from security vendor AVG Technologies.

AVG is seeing between 200,000 to 300,000 new websites per day hosting code that can in some cases result in a PC being infected with malware just by visiting the site, said Roger Thompson, AVG's chief research officer.

Up to 70 percent of those websites are regular ones that have been hacked in order to host malicious code, a statistic that shows how poor website security is across the Internet. The remainder are custom-built sites, he said.

Of those custom-built sites, however, there is some positive news. One common social-engineering trick is to put up a website offering codecs, or bits of software used to encode and decode video files. While purporting to be a codec, the file is often malicious software designed to steal data.

AVG found that up to 94 percent of the fake codec websites are taken offline within 10 days, with 62 percent taken down in a day or less. In the past, the sites may have stayed online as long as two weeks, showing that ISPs (Internet service providers) appear to be acting faster to remove them and current mechanisms for reporting bad websites are having an impact.

Still, the sheer number of sites infected may mean that the time online is less important as long as the hackers are attracting traffic.

Thompson said many hackers seek out less-professional websites with unpatched versions of "htaccess," a configuration file used to manage access to certain pages on a website.

Htaccess is a powerful file, since it can be manipulated to redirect users to other websites depending on how they came to the website, Thompson said. For example, it can be configured to direct users who found the website through Yahoo or Google to a different, hostile website which looks to see if the PC is potentially hackable.

But if the hostile website is being visited by a bot and not coming from a search engine, the site will refuse to serve up any exploits, making it difficult for security analysts to automatically scan the web for bad sites, Thompson said.

However, hackers are getting lazy. They often reuse the same JavaScript and HTML (Hypertext Markup Language) code used to launch attacks, which makes those attacks easy to identify. That's good, since the underlying binary attack code can often also be tricky for security software to identify.

"That's a pretty good bottleneck," Thompson said. "It's like having a letter bomb with the outside of the envelope saying 'I'm a bomb'."

Thompson developed a product called LinkScanner that scans websites to see if it hosts malware. He sold his company, Exploit Prevention Labs, to AVG - then Grisoft - in December 2007. AVG has since incorporated LinkScanner into its free product, AVG 8.0 Free Edition.

No responsibility can be taken for the content of external Internet sites.


print this article

Return to internet news headlines
View Internet News Archive

Share with: