New Q3'09 malware data, and the Dasient Infection Library

Ed. Note: The data in this post is drawn primarily from Dasient's proprietary malware analysis platform, which gathers data on web-based malware attacks from across the web and in the last six months has been used to help tens of thousands of site owners address their web-based malware issues. This is the first in a series of regular reports on these trends.

As we've discussed in this space before, we are seeing a fundamental shift in how malware is being distributed: Attackers are focusing more than ever on compromising legitimate websites and using them to distribute malware. As a result, more and more sites are feeling the effects of web-based malware infection, which can include loss of traffic, decline in revenue, and damage to brand equity.

This trend is underlined by the data we've gathered on the third quarter of 2009, which saw significant activity on the web-based malware front. During that span, Dasient identified more than 52,000 web-based malware infections, making for a total of more than 72,000 unique malware infections identified and catalogued since our malware analysis platform launched.

Based on the telemetry data we've gathered from the web, we estimate that more than 640,000 sites and approximately 5.8 million pages were infected in the quarter. This is a substantial increase from data published by Microsoft in April 2009, which pegged the number of infected pages per quarter at a little more than 3 million. This increased activity is also reflected in the rapid growth of the blacklists maintained by search engines, browsers, and anti-virus software companies. The Google blacklist alone has more than doubled in the last year, and at certain points has been adding 40,000 new sites per week.

This shift has been accelerated by the fact that using legitimate sites as a delivery method enables attackers to infect large numbers of endpoints at once, and by the trend toward increasing complexity in and interoperability between websites and web applications (which is in turn opening up more and more attack surfaces).

Substantial portions of sites being infected

While it often takes only a couple of infected pages to harm users or land a site on one of the many blacklists, our research suggests that when sites are infected, the bad code is installed on a significant portion of the pages on those sites. In Q3'09, the infections on newly compromised sites of 10 pages or more spread to an average of 19% of those sites' pages.

This number is significant for a couple of reasons. For one, the greater the percentage of a site that's infected, the greater the chances are that the site will spread malware to users or be flagged by a blacklist provider. For another, modern web-based malware infections are frequently complex and heavily obfuscated, making it a challenge even for experienced webmasters to identify all the bad code on the site and remove it. The more infected pages there are on the site, the longer it can take to address the infection. And if the site has already been blacklisted (which is often the case), then the site will take a hit in traffic, reputation, and revenue with each day that passes during the cleanup and blacklist appeal process.

High reinfection rate

Another trend worth noting from Q3 is the high reinfection rate for sites, which came in at 39.6%. There are a number of factors that could contribute to a high reinfection rate, including the tendency for attackers to look for attack vectors common to large numbers of sites and then develop automated attack scripts that will repeatedly seek out those vectors and exploit them.

The sheer number of available attack vectors likely also plays a part. Common attack vectors include compromised FTP credentials, server-side vulnerabilities, unpatched or unknown web application vulnerabilities, and syndicated ad networks serving malicious ads. With attackers embracing scale and automation, and with so many ways for even well-secured sites to be compromised, it's becoming more and more important for site owners to employ tools that can help them regularly monitor their sites for infection and quickly address any issues that arise.

New attack techniques

As you can see in the graph below, the vast majority of the web-based malware attacks in Q3 could be classified as JavaScript (54.8%) and iFrame (37.1%) attacks, with "other" attacks accounting for only 8.1%.

One of the challenging things about trying to protect sites from the threat of web-based malware is that the attacks often evolve very quickly and make use of a number of obfuscation techniques to evade traditional malware scanners. We saw plenty of this activity in Q3, with some notable recent examples being dynamically generating the SRC attribute in iFrames to foil scanners that look at SRC attributes; using partially or fully encoded URLs to frustrate scanners that look for regular expressions; and adding phrases like "analytics-google" to malicious code to fool webmasters into thinking the code is legitimate.

Dasient to open up web-based malware Infection Library

The Dasient Web-Anti Malware (WAM) service regularly monitors our customers' sites for signs of a web-based malware infection. When an infection is detected, it notifies the customer immediately, providing full diagnostic information on the infection. It can also automatically strip out the bad code from infected pages before they're served to the site's users -- keeping those users safe and keeping the site off the blacklist. We're proud to be able to provide this service to our customers, and have received great feedback since launching earlier this year.

But as the threat of web-based malware continues to grow, one of the things we're hearing from the web, security, and IT professionals we work with is that they need more information to help them keep track of the threat and ensure that they have the tools they need to address it. With that in mind, we will now start providing these professionals with a view into the Dasient Infection Library, which in just a few months has accumulated data on more than 70,000 different web-based malware infections.

To start, we'll be providing information on the top 10 web-based malware attacks for the week, as well as some other basic trend information on the latest attacks. We'll also be publishing relatively new infections that our platform finds to a dedicated Twitter feed. We hope to expand the view we offer into our Infection Library in the future, and are looking forward to your feedback on the kinds of data and functionality you'd find useful.

If you're a business owner and you'd like to learn more about how Dasient WAM can help protect your business, head here. If you're a web hosting provider and you'd like to learn about partnership opportunities with Dasient, check out this page. And no matter who you are, please be sure to check out our Twitter feed at http://twitter.com/dasient for all the latest in web-based malware and general security news.

More industry attention on web-based malware

Yesterday, Google announced that it plans to start providing owners of malware-infected sites with samples of the bad code that its scanners have uncovered. This new functionality is launching as an experimental feature in Webmaster Tools, and as I mentioned in the talk I gave at Google this past July, we're excited to be working in concert with Google and others to tackle the threat of web-based malware and help make the web a safer place overall.

This announcement clearly underlines the growing need for this kind of information and for new tools to help site owners protect themselves and their users. As we've mentioned before in this space, millions of legitimate webpages are infected with web-based malware every month, and the size of the blacklists maintained by search engines, browsers, and AV providers continues to grow.

Another issue the announcement raises is how difficult it can be for businesses whose sites have been infected to locate the source of the infections and address them (especially since the malicious code is sometimes heavily obscured). And since businesses often don't discover these infections until their sites have been blacklisted, they're taking a hit in traffic, revenue, and reputation with every hour that passes as they try to solve the problem.

We've helped tens of thousands of site owners deal with web-based malware infections in the last eight months -- providing not just snippets, but also full, regular site scans, immediate infection alerts, and automatic remediation tools -- and we've seen firsthand how frustrating these infections can be for them, and how helpful services like Dasient WAM can be.

If you're concerned about web-based malware infections and the impact they can have on your business, sign up for Dasient's monitoring service, which can identify infections and alert you before your site ends up on one of the blacklists. We also encourage you to try out our free, open-source server plugin, which will automatically block any malicious code we detect from being served to users -- helping you keep those users safe and keep your site off the blacklists.