New Twist on IRS Spam

There is a new twist on the IRS emails that have been delivering zbot and other threats over the last month. In some new emails, reports Gary Warner, the link contained in the message is to Geocities.

An example from the CyberCrime & Doing Time blog:
hxxp://geocities.com/FreddyCampbell36/ohuloc.htm

While the users will ultimately end up at the commonly used http://www.irs.gov.blah.blah.co.uk/fraud_application/directory/statement.php?etc... type url, the attackers are now using Geocities as an intermediary.

This makes it increasingly difficult for spam and av scanners to detect the malicious URL and block the email from reaching unsuspecting users. Warner reported that a VirusTotal scan showed very low detection rate - another repackaged zbot to bypass detection.

For more information, including a list of dangerous URLs visit the CyberCrime & Doing Time blog!

http://garwarner.blogspot.com/2009/10/irs-zeus-via-geocities.html

Read rest of entry

Web Threats Booming: APWG First Half Report

The Anti-Phishing Working Group (APWG) released their first half "Phishing Activity Trends Report" with some startling statistics. For those that have not heard of the APWG, the organization devoted to the elimination of phishing and identity theft scams.

The report gives statistics on many trends inlcuding phishing trends, rogue AV, keyloggers and others and fully reinforces the fact that the number of threats on the internet continues to grow.

Some of the staggering statistics:

Read rest of entry

Introductory Post

As internet threats continue to evolve it's becoming clear that web threats and blended threats are becoming the most predominant danger to network security. Green Cloud Security and this blog are dedicated to the proliferation of information about web security issues - increasing awareness for both network administrators and regular internet users.

The creation of this blog comes on the heels of the Websense Security Labs "State of Internet Security" for the first half of 2009. There are many fascinating statistics that are presented in this report.

Some Highlights Directly from the Report:

• Websense Security Labs identified a 233 percent growth in the number of malicious Web sites in the last six monthsand a 671 percent growth during the last year.
• 77 percent of Web sites with malicious code are legitimate sites that have been compromised. This remains
unchanged from the last six-month period.
• 87.7 percent of email messages were spam. This represents a three percent increase over the last six months.
• 85.6 percent of all unwanted emails in circulation during this period contained links to spam sites and/or malicious Web sites.
• 95 percent of user generated comments to blogs, chat rooms and message boards are spam or contain
malicious links.
• Researchers from Harvard and Cambridge estimate that 75.8 percent of phishing sites are hosted on
compromised servers.

The full report can be downloaded from the WebSense Newsroom. There is also a video version of the report available.

One of the key concepts to be taken from this report is the importance of web filtering as it pertains to malware and other internet threats. Using web based blocking can significantly decrease the "window of vulnerability" of a particular threat. While anti-virus vendors scramble to create and release definitions (averaging 22 hours according to this report), web security vendors can block a virus download in a matter of minutes if done properly. While anti-virus programs will likely always have their place, web security is quickly becoming the most important factor in internet threat prevention.

Blended threats, which are usually in the form of an email containing a link to a web page with harmful code or files are also showing no signs of slowing either. Real-time web filtering can prevent access to the link, and infection. If almost 88% of all email is spam, and 85% of that mail contains links to malicious and spam sites, then 75% of all email contains links to malicious and spam sites - a serious problem.

This site is dedicated to keeping up to date information on any web threats, blended threats, botnets. Please bear in mind that this is still very much in the building stages. Please follow via RSS or Twitter, and thanks much for reading.

Read rest of entry