San Francisco (CA) – A report published by IBM’s X-Force indicates that there has been a staggering 508 percent increase in the number of malicious Web links. X-Force Director Kris Lamb told TG Daily that web client, server, and content threats have converged to create an ‘untenable risk landscape.’
“I think we have reached a unique point in terms of the convergence of technology that powers the web, as well as threats and threat scenarios. However, while the report paints a grim picture and may appear rather daunting, it also reveals a more positive picture in certain areas,” said Lamb. “For example, there is significantly more public awareness surrounding the threat of phishing. Even technically unsophisticated individuals are cognizant of the fact that the web is being used by criminal elements to extract critical financial data from unsuspecting victims.”
Lamb explained that the current generation of browsers – which feature plugin functionality and Active X – have become an “atractive” target for hackers.
“The trends highlighted by the report seem to indicate that the Internet has finally taken on the characteristics of the Wild West where no one is to be trusted. There is no such thing as safe browsing today and it is no longer the case that only the red light district sites are responsible for malware. We’ve reached a tipping point where every Web site should be viewed as suspicious and every user is at risk.”
Lamb also noted that web security wasn’t just a browser or client-side issue, as criminals were leveraging insecure Web applications to target the users of legitimate Web sites. Indeed, the X-Force report identified a significant rise in Web application attacks with the intent to steal and manipulate data and take command and control of infected computers. SQL injection attacks – instances where criminals inject malicious code into legitimate Web sites – rose 50 percent from Q4 2008 to Q1 2009 and nearly doubled from Q1 to Q2.
“Two of the major themes for the first half of 2009 are the increase in sites hosting malware and the doubling of obfuscated Web attacks,” stated Lamb. “Criminals are taking advantage of the fact that there is no such thing as a safe browsing environment and are leveraging insecure Web applications to target legitimate Web site users.”
He added that the industry was likely to experience “new unique threat types” in the future, due to the mass consumption of mobile devices and cloud computing.
“The mass consumption of mobile devices, coupled with an increase of online applications, will drive accelerated activity focused on compromising web browsers. We are also seeing a decentralization of infrastructure, propelled by cloud computing. This new theme can be expected to bring a lot of changes with it – including non-traditional threat types that are unique to preying on decentralization of IT.”
The full X-Force report can be downloaded at: http://www-935.ibm.com/services/us/iss/xforce/trendreports/
