Google Postini team highlights increase in email JavaScript attacks

Data posted to the official Google blog by Adam Hollman and Gopal Shah of the Google Postini services team revealed a marked 16% increase in spam volume during Q2 of this year when compared with Q1 2010.

In addition, virus traffic increased slightly, by 3%, in Q1 vs. Q2. The data from Google, however, showed an astounding 260% increase in year-over-year virus traffic for Q2. “These trends tell us that spammers are still extremely active, and their botnets produce high levels of spam and virus traffic”, wrote the duo in their blog posting.

Another intriguing find by Google revolves around spam message size. The Postini team said that spam message size increased by 35% from Q1 to Q2 of this year, which “points to the fact that spammers are sending more image-based spam, as well as viruses as attachments”.

Hollman and Shah also said that trends gleaned from the Google Postini data show a recent surge in obfuscated JavaScript attacks via email, which are a special “hybrid between virus and spam messages”. These messages take the form of non-delivery report (NDR) emails; however, they contain hidden JavaScript.

“In some cases, the message may have forwarded the user’s browser to a pharma site or tried to download something unexpected, which is more virus-like”, noted the Google team. “Since the messages contained classic JavaScript [that] generates code, the messages could change themselves and take multiple forms, making them challenging to identify”.

To reassure customers who use the popular Postini email service, the Google team said that its spam filters had a jump on receiving these messages and the company has updated its anti-spam engine to identify obfuscated JavaScript and quarantine the messages.

What’s hot on Infosecurity Magazine?