Related Links

Related Stories

  • Nine lives - when malware becomes self-modifying
    As the Conficker (aka Downadup and Kido) worm proved when it first appeared in October 2008, there's more to a piece of malware code than meets the eye, especially when it is self-updating. But can self-updating also mean self-modifying? Steve Gold investigates whether an IT security manager's nightmare has become programming reality...
  • Search for security
    With more than 30 000 web pages being infected every day, search engine results could increasingly lead to malware infection. Kari Larsen asks what the search engines are doing to mitigate security threats, and how users can protect themselves.
  • Information security threats in H1 2009: malware and rogue security software
    Microsoft has just released its Security Intelligence Report volume 7 (SIRv7) for the first half (H1) of 2009 exploring the most prevalent information security threats - malware and rogue security software.
  • Batten down the hatches
    Due to the horrifying quantity of vulnerabilities, and often limited time and budget, application and database security can be quite a headache. Limiting privileges and access, however, is a good place to start, finds Danny Bradbury
  • What’s in store for 2010?
    The Noughties are behind us now, but memories of a decade of data breaches will continue to haunt the infosec professional. If only there was a way of knowing what the threat landscape would look like in the months to come. Well you’re in luck as Davey Winder has dusted off the crystal ball and spoken to a broad church of infosec professionals to get some informed predictions for 2010

News

Panda Security research shows high incidence of malicious email

30 January 2009

Research just released by Panda Security claims that just 8.6 per cent of email that reached companies last year was non-malicious.

The IT security firm says that, out of 430 million emails its managed email operation analysed, 89.88 per cent were spam and 1.11 per cent were infected with some form of malware.
The fall-out from this torrent of infected email is that 301 000 zombie PCs were created and used, mainly for distributing spam, says Panda, adding that its TrustLayer Mail managed email service, showed rates of spam only falling to below 80 per cent during January.
Infosecurity notes that many tier one ISPs in the UK automatically filter the more obvious spam as it flows across their network, to save on their own, as well as the bandwidth of their customers and the internet in general.
Likewise with malware-infected email, which many ISPs attempt to spot before it reaches their customers, and remove from the email chain.
Plus.net, the Sheffield-based ISP, for example, makes use of deep- level packet inspection techniques to analyse the flow of email and internet traffic across its network, and without invading the privacy of its customers, spool off infected emails along with obvious spam.
However the ingenuity of spammers, phishing email creators and malware distributors is still responsible for a lot of unnecessary email,
Panda says that Netsky.P worm was the program most frequently detected among its users.
The malware activates automatically using a technique whereby, when users view the infected message through the Microsoft Office Outlook preview pane, it takes advantage of the Autorun feature to trigger the automatic execution of email attachments.
This technique is classed as a multi-stage attack in IT security terms, Infosecurity notes.
"The fact that these two malicious codes often act in unison explains the high number of detections of both," says Luis Corrons, PandaLabs' technical director, in his report summary.
"Cyber crooks often launch several strains of malware with each exploit to increase the chances of infection, so even if users whose systems are up-to-date are immune to the exploit, they could still fall victim to infection by the worm if they run the attachment," he added.
 
Panda's Top 10 malware in its 2008 email rankings were:

Netsky.P.worm
Bck/Rukap.G
Exploit/iFrame
Trj/Dadobra.BL
Generic Malware
Trj/Downloader.PSJ
Trj/SpamtaLoad.DO
Trj/Downloader.PWR
Bck/Haxdoor.PL
Trj/Spamtaload.DZ

According to Corrons, for many companies, spam is more than just a nuisance.
It consumes bandwidth, wastes employees' time and can even cause system malfunctions. In the end, it all results in a loss of productivity, he says.
 
 
 

 

This article is featured in:
Application Security Identity and Access Management Malware and Hardware Security

 

Comment on this article

You must be registered and logged in to leave a comment about this article.