Politically motivated attacks will become more widespread in 2009

Mumbai : Secure Computing Corporation published the Q3 2008 Internet
Threat Report containing data and analysis, evaluating both e-mail and web-based
threats. The report was compiled by the Secure Computing research team and based
on the company's TrustedSource Global Reputation System.

Among its findings, Q3 saw the emergence of new malware targeting users of
the social networking sites, as well as panic-inducing 'bank failure spam'
intending to capitalize on the current financial crisis. 'Scareware' programs
also spread rapidly, while election-related spam soared, with Senator Obama
easily defeating his opponent in terms of spam popularity.

Q3 Spam trends statistics and analysis

Spam volume returned to record highs in Q3. The infection of machines via
e-mail and Web-based infections continued in Q3, with over 5,000 new zombies
created every hour. The United States continued its role as the largest
originator of spam messages, nearly doubling its worldwide share from 16.6
percent in Q2 (2008) to 32.1 percent in Q3. The report also saw the emergence of
'Breaking News' spam as a new vehicle that enticed readers to click for breaking
news flashes with interesting and provocative headlines. Misguided 'Delivery
Status Notifications' made a strong resurgence onto the 'Most Common Spam' list.
Spammers continued to leverage election topics to lure users. After the second
presidential debate on Oct 7, 2008, Obama gained popularity among spammers, and
over 80 percent of election-related spam currently bears his name. Secure
Computing's TrustedSource Labs estimates the number of worldwide US
election-related spam e-mail to be approximately 100 million messages per day.

Malware statistics and analysis

The United States and China dominate the world in the number of hosted
websites, which distribute malware, with nearly 60 percent of all malware-infected
URLs served from these two countries. In terms of phishing attacks, the United
States and the Netherlands host nearly 60 percent of all URLs used. Phishing
attacks spiked significantly following the announcements of various bank
failures in late September. While there was no strong trend towards using any
one specific bank or bank failure, overall increases in phishing activity in the
days following each major announcement were recorded.

Previously, successful SQL injection attacks on legitimate websites included
links directing users to one of a few dozen or so malicious sites. This summer,
however, more attacks were launched where each infected page included a link to
a unique and individualized malicious site (a one-to-one infection/attack
ratio). A large increase in the number of heavily promoted phony malware/spyware
removers or 'scareware' occurred at the end of the quarter. Secure research
expects this to be an increasing problem that will rapidly evolve to a greater
level of sophistication.

Predictions moving forward

Secure Computing Research offered predictions regarding this issue in the
future. During the 2006 holiday season, mail volumes reached record 100 billion
daily messages. As we enter the 2008 season, the number has risen to 200 billion
messages. Secure predicts a 25 percent increase in Q4, and new records for mail
and spam volumes. As the global financial crisis continues, perpetrators will
take advantage of the panic and fear among consumers and increase their targeted
phishing attacks substantially. With upcoming holiday, spammers will
increasingly use the lure of free coupons and gift cards. Today, most malware
attacks are financially motivated and target end-users. In the coming year, we
believe there is a greater likelihood of attacks meant to manipulate public
opinion in order to exploit the stock market.

Going into 2009 and beyond, politically motivated attacks will become more
widespread, like attacks on national cyber infrastructure by hackers.
Denial-of-service and website-compromise attacks against key government and
economic cyber resources of Estonia and Georgia are foreshadowing things to
come. In 2009, web attack toolkits will add new target platforms to their
arsenal of 'supported' targets. The iPhone is one such candidate, as are 'Web
2.0' social platforms such as Facebook and MySpace. As the popularity of these
platforms increase, the likelihood of them being targeted rises as well.

By the end of 2009, about half of all web-borne malware will likely be hosted
on compromised legitimate Websites as it becomes increasingly difficult for
criminals to purchase malware hosting services from companies that once looked
the other way.

Over the course of Q3, the TrustedSource reputation system was able to
identify over 600 new websites that have been deployed and tagged with a
malicious reputation prior to serving any malicious content. Identifying these
websites proactively through the use of traffic analysis and examination of
historical connections to criminal individuals or networks is now essential as
they are increasingly used to deploy zero-day/zero-hour malware code that is not
detected by the traditional signature-based, anti-malware products.