Shift Happens: How Malware is Delivered

[Lite]

Note: I know this is a couple of years old... but its still an worthwhile read for those interested in Computer Security. The information given is still valid.

A year or two ago, most malware was spread via e-mail attachments, which resulted in mass outbreaks such as Bagle, Mydoom, and Warezov. Nowadays sending .EXE attachments in e-mail doesn't work so well for criminals because almost every company and organization is filtering out such risky attachments from their e-mail traffic.

The criminals' new preferred way of spreading malware is via drive-by downloads on the Web. These attacks often still start with an e-mail spam run but the attachment in the e-mail has been replaced by a web link, which takes you to the malicious web site. So instead of getting infected over SMTP, you get infected over HTTP.

Infection by a drive-by download can happen automatically just by visiting a website, unless you have a fully patched operating system, browser, and browser plug-ins. Unfortunately, most people have some vulnerabilities in their systems. Infection can also take place when you are fooled into manually clicking on a download and running a program from the web page that contains the malware.

There are several methods criminals use to gather traffic to malicious websites. A common approach is to launch an e-mail spam campaign containing messages that tempt people to click on a link. Messages such as "There is a video of you on YouTube", or "You have received a greeting card", or "Thank you for your order" have been popular baits.

Another method used by criminals is to create many web pages with thousands of different keywords which are indexed by Google, and then simply wait for people to visit these sites. So when you do a search for something innocuous such as "knitting mittens" (as a random example), and click on a search result that looks just like all the others, you are actually getting your computer infected. Typically, an infection by an automatic exploit happens without you realizing it or seeing anything strange on the computer screen.

The third method of distributing malware involves the criminals hacking into existing high profile, high traffic web sites. Unlike the joke defacements that some hackers played on the front pages of prominent web sites in the past, today's criminal hackers don't change the front page at all. They simply insert a line of JavaScript on the front page which uses an exploit to infect your machine when you visit. Everything works and looks as normal.

This has happened to the websites of some popular magazines that can have a million users every single day. People trust sites that are part of their daily routine, and they don't suspect that anything bad could happen when they go there.

Another vector for drive-by downloads are infiltrated ad networks. We are seeing more and more advertising displayed on high-profile websites. By infiltrating the ad networks, the criminals don't have to hack a site but their exploit code will still be shown to millions of users, often without the knowledge of the webmaster of those sites.

It is important to be aware of this shift from SMTP to HTTP infections, which can be exploited by criminals in many ways. Companies often measure their risk of getting infected by looking at the amount of stopped attachments at their e-mail gateway. Those numbers are definitely going down, but the actual risk of getting infected probably isn't.

Individuals and companies should therefore be scanning their web traffic for malware — as well as filtering their FTP traffic. In parallel to the switch from SMTP to HTTP as a way of spreading malware, we are now also seeing more and more malicious e-mails that link to malware via FTP links.

By: Mikko

[DKT27]

Many of the points mentioned here are still common these days. A kiddo will change the frontpage and will happy mention something like pwned. An expert will inject some codes. A black hat will exploit it. A white hat has it's own sophisticated and step by step ways to inform the admin/owner about it.

About emails, it's best to right click and view at it's code/properties. But never open them. This way I've helped hotmail guys ban many spammers and phishers etc.

[Sl@pSh0ck™]

Good read ... thanks lite :)