New Q3'09 malware data, and the Dasient Infection Library

Ed. Note: The data in this post is drawn primarily from Dasient's proprietary malware analysis platform, which gathers data on web-based malware attacks from across the web and in the last six months has been used to help tens of thousands of site owners address their web-based malware issues. This is the first in a series of regular reports on these trends.

As we've discussed in this space before, we are seeing a fundamental shift in how malware is being distributed: Attackers are focusing more than ever on compromising legitimate websites and using them to distribute malware. As a result, more and more sites are feeling the effects of web-based malware infection, which can include loss of traffic, decline in revenue, and damage to brand equity.

This trend is underlined by the data we've gathered on the third quarter of 2009, which saw significant activity on the web-based malware front. During that span, Dasient identified more than 52,000 web-based malware infections, making for a total of more than 72,000 unique malware infections identified and catalogued since our malware analysis platform launched.

Based on the telemetry data we've gathered from the web, we estimate that more than 640,000 sites and approximately 5.8 million pages were infected in the quarter. This is a substantial increase from data published by Microsoft in April 2009, which pegged the number of infected pages per quarter at a little more than 3 million. This increased activity is also reflected in the rapid growth of the blacklists maintained by search engines, browsers, and anti-virus software companies. The Google blacklist alone has more than doubled in the last year, and at certain points has been adding 40,000 new sites per week.

This shift has been accelerated by the fact that using legitimate sites as a delivery method enables attackers to infect large numbers of endpoints at once, and by the trend toward increasing complexity in and interoperability between websites and web applications (which is in turn opening up more and more attack surfaces).

Substantial portions of sites being infected

While it often takes only a couple of infected pages to harm users or land a site on one of the many blacklists, our research suggests that when sites are infected, the bad code is installed on a significant portion of the pages on those sites. In Q3'09, the infections on newly compromised sites of 10 pages or more spread to an average of 19% of those sites' pages.

This number is significant for a couple of reasons. For one, the greater the percentage of a site that's infected, the greater the chances are that the site will spread malware to users or be flagged by a blacklist provider. For another, modern web-based malware infections are frequently complex and heavily obfuscated, making it a challenge even for experienced webmasters to identify all the bad code on the site and remove it. The more infected pages there are on the site, the longer it can take to address the infection. And if the site has already been blacklisted (which is often the case), then the site will take a hit in traffic, reputation, and revenue with each day that passes during the cleanup and blacklist appeal process.

High reinfection rate

Another trend worth noting from Q3 is the high reinfection rate for sites, which came in at 39.6%. There are a number of factors that could contribute to a high reinfection rate, including the tendency for attackers to look for attack vectors common to large numbers of sites and then develop automated attack scripts that will repeatedly seek out those vectors and exploit them.

The sheer number of available attack vectors likely also plays a part. Common attack vectors include compromised FTP credentials, server-side vulnerabilities, unpatched or unknown web application vulnerabilities, and syndicated ad networks serving malicious ads. With attackers embracing scale and automation, and with so many ways for even well-secured sites to be compromised, it's becoming more and more important for site owners to employ tools that can help them regularly monitor their sites for infection and quickly address any issues that arise.

New attack techniques

As you can see in the graph below, the vast majority of the web-based malware attacks in Q3 could be classified as JavaScript (54.8%) and iFrame (37.1%) attacks, with "other" attacks accounting for only 8.1%.

One of the challenging things about trying to protect sites from the threat of web-based malware is that the attacks often evolve very quickly and make use of a number of obfuscation techniques to evade traditional malware scanners. We saw plenty of this activity in Q3, with some notable recent examples being dynamically generating the SRC attribute in iFrames to foil scanners that look at SRC attributes; using partially or fully encoded URLs to frustrate scanners that look for regular expressions; and adding phrases like "analytics-google" to malicious code to fool webmasters into thinking the code is legitimate.

Dasient to open up web-based malware Infection Library

The Dasient Web-Anti Malware (WAM) service regularly monitors our customers' sites for signs of a web-based malware infection. When an infection is detected, it notifies the customer immediately, providing full diagnostic information on the infection. It can also automatically strip out the bad code from infected pages before they're served to the site's users -- keeping those users safe and keeping the site off the blacklist. We're proud to be able to provide this service to our customers, and have received great feedback since launching earlier this year.

But as the threat of web-based malware continues to grow, one of the things we're hearing from the web, security, and IT professionals we work with is that they need more information to help them keep track of the threat and ensure that they have the tools they need to address it. With that in mind, we will now start providing these professionals with a view into the Dasient Infection Library, which in just a few months has accumulated data on more than 70,000 different web-based malware infections.

To start, we'll be providing information on the top 10 web-based malware attacks for the week, as well as some other basic trend information on the latest attacks. We'll also be publishing relatively new infections that our platform finds to a dedicated Twitter feed. We hope to expand the view we offer into our Infection Library in the future, and are looking forward to your feedback on the kinds of data and functionality you'd find useful.

If you're a business owner and you'd like to learn more about how Dasient WAM can help protect your business, head here. If you're a web hosting provider and you'd like to learn about partnership opportunities with Dasient, check out this page. And no matter who you are, please be sure to check out our Twitter feed at http://twitter.com/dasient for all the latest in web-based malware and general security news.