RSA 2011: Avast analyst discusses 'trust phenomenon' and infections

Speaking at the RSA 2011 event in San Francisco, Sejtko explained that the danger is in the familiar, everyday trusted places on the internet which are as much a part of a daily routine, just like your morning coffee.

"Users believe a website is safe just because it is well-known or they have repeatedly visited it over a long period of time", he said, adding that, by using the 'trust phenomenon' and these innovative malware families, cybercriminals are targeting safe zones on the internet to infect users.

These safe zones – far away from the 'usual suspect' areas of adult content, warez, and download sites – are thought to have been responsible for somewhere between 4 and 5 million infections over the last year.

Interestingly, Sejtko claims internet users tend to go into denial when their IT security software sounds an alarm when they are visiting their favourite sites.

"www.***.nl is a football fan page I have been visiting for years. I don't believe it'd be an untrusted party", one user is quoted as telling Avast's researchers via email.

"Would you please stop considering this as a virus please? I don't have much time and those interruptions make me lose this time", said another.

"These are actual user comments sent to us from users as the result of an Avast detection on each of the three malware families in our presentation" said Sejtko.

"People send us complaints about 'false positive detections' and even disable their AV protection in order to reach their desired location – then they wish they hadn't", he added.

The Avast senior virus analyst says that the three malware families found in its investigation include the Ill range, Kroxxu and Prontexi.

The Ill family is said to redirects users to malware distribution sites and encompasses more than 3,400 malware distribution domains and 200,000 infected domains.

Kroxxu, meanwhile, is a self-reproducing botnet based on compromised websites and servers and distributes password stealers.

Sejtko says that Prontexi is used for distributing rogue anti-virus programs and spreads primarily through ads and search engine results.

All three, he explained, are technologically very different but are effective in catching people.

"Bad guys move in cycles, creating new variants with the knowledge gained from previous generations", he said, adding that, when you get an alert from your antivirus program, don't ignore it.

What’s hot on Infosecurity Magazine?